chore(deps): base64 0.22 -> 0.23 in the host and pf-update-check

ureq 3 already pulls 0.23, so the tree compiled both minors purely because our
two direct declarations named the older one. The API we use — `Engine`,
`engine::general_purpose::STANDARD`, `encode`/`decode` — is unchanged in 0.23;
no source edits.

Both are declared `default-features = false, features = ["std"]` rather than
taking the defaults. 0.23 added `simd-unsafe` (hand-written AVX2/NEON engines)
as a DEFAULT-ON feature, and ureq declares base64 with default features off, so
today that code is not in the tree. Accepting the defaults here would unify the
feature on and quietly add an unsafe SIMD engine to every artifact as a side
effect of a currency bump. Whether to enable it is a perf question deserving a
measurement and its own commit; this one changes versions, not exposure. `std`
covers every call site (encode to `String`, decode to `Vec`).

base64 0.22 does NOT leave the tree: `rcgen` -> `pem` 3.0.6 is now its sole
remaining consumer, and it stays one after the rcgen 0.14 bump later in this
batch — 0.14 still depends on `pem` "3.0.2", which resolves to the same 3.0.6,
which still uses base64 0.22. Clearing that last copy is upstream's move (a
`pem` release on 0.23), not ours.

Verified on CachyOS (rustc 1.96.0):
  cargo clippy -p punktfunk-host -p pf-update-check --locked --all-targets -- -D warnings   OK
  cargo clippy -p punktfunk-host -p pf-update-check --locked -- -D warnings                 OK  (shipping build)
  cargo test -p punktfunk-host --bins --locked    501 passed, 0 failed, 2 ignored
  cargo test -p pf-update-check --locked          32 passed, 0 failed
  cargo fmt --all --check                         clean

Cargo.lock

@@ -3201,7 +3201,7 @@ version = "0.27.0"
 dependencies = [
  "anyhow",
  "aws-lc-rs",
- "base64 0.22.1",
+ "base64 0.23.1",
  "serde",
  "serde_json",
  "ureq",
@@ -3614,7 +3614,7 @@ dependencies = [
  "aws-lc-rs",
  "axum",
  "axum-server",
- "base64 0.22.1",
+ "base64 0.23.1",
  "cbc",
  "futures-util",
  "hex",

crates/pf-update-check/Cargo.toml

@@ -33,7 +33,9 @@ serde_json = "1"
 # runner. Naming it here makes the crate build standalone instead of relying on who else is in
 # the selection.
 aws-lc-rs = { version = "1", features = ["prebuilt-nasm"] }
-base64 = "0.22"
+# Feature selection matched to ureq's (and punktfunk-host's) on purpose — 0.23's default-on
+# `simd-unsafe` engine stays off, so a currency bump doesn't quietly add unsafe SIMD to the tree.
+base64 = { version = "0.23", default-features = false, features = ["std"] }
 # Small, sync, bundles webpki roots — no system cert store dependency, which matters on the
 # Deck (Decky's embedded Python has no usable roots either; see clients/decky/main.py).
 # ⚠ `rustls-no-provider`, NEVER the default `rustls` feature — that one pulls `_ring`, which would

crates/punktfunk-host/Cargo.toml

@@ -97,7 +97,13 @@ rand = "0.9"
 hex = "0.4"
 # Cover-art delivery in the game library: encode Lutris's local JPEGs into `data:` URLs and decode
 # the Epic launcher's base64 `catcache.bin`. Cross-platform (Linux Lutris art + Windows Epic art).
-base64 = "0.22"
+# `default-features = false` + `std` deliberately: 0.23 added a default-ON `simd-unsafe` feature
+# (hand-written AVX2/NEON engines). ureq already declares base64 exactly this way, so taking the
+# defaults here would unify the feature ON and pull that unsafe code into every build as a side
+# effect of a version bump. Turning it on is a perf decision worth making on purpose, with a
+# measurement — not one to inherit silently. `std` covers everything we call (`Engine::encode`,
+# `decode` to a `Vec`).
+base64 = { version = "0.23", default-features = false, features = ["std"] }
 # Blocking HTTP for the library cover-art warmer (no-auth GOG api.gog.com + Xbox displaycatalog),
 # run on a background thread off the hot path. `ureq` is small + sync (no tokio here) and bundles
 # webpki roots (no system cert dependency). Cross-platform so the fetch/parse code is compiled +