rust-migration S0: axum server skeleton + /api/version (#122)

[t2vi]

First phase of the Rust server migration — ADR 0033 (private overlay).
Part of epic #120. Closes #122.

What lands

A Rust arrgh-server crate in server/, alongside the .NET project.
cargo only compiles .rs, dotnet only .cs — they coexist until S10.

• axum 0.8 app: config.rs (env var names unchanged — DatabasePath, PluginHostUrl, DownloadDir, JwtSecret), tracing from LOG_LEVEL, AppError → {"error": …} JSON, AppState + UpdateCache (port of the .NET UpdateCache singleton), graceful shutdown on SIGINT/SIGTERM.
• GET /api/version ported — body { current, latest, release_url }, byte-identical shape to .NET. Version = server/Cargo.toml package version (0.1.7), compiled in.
• Tests — server/tests/version.rs, tower::oneshot, mirrors api-tests/version.hurl (current isString + semver; plus the update-available path).
• nginx — /api/version → :3001 (Rust), /api/ → :3000 (.NET). Longest-prefix match; one block added per phase, catch-all deleted at S10.
• Dockerfile — stage 0 cargo build --release; entrypoint.sh runs the binary on :3001 beside the .NET server.
• .github/workflows/rust.yml — cargo fmt --check + clippy -D warnings + test --locked, path-filtered to server/**.
• .dockerignore — was missing; added so server/target (380 MB) etc. stay out of the build context.

Deferred from the S0 checklist (with rationale)

Item	Moved to	Why
SQLx pool + 0001_baseline.sql (EF schema reproduction)	S2 (#124)	First actual DB use is auth; reproducing the whole EF schema now is error-prone busywork ahead of need
utoipa + Scalar UI	later	One endpoint doesn't need generated OpenAPI
arrgh-core / arrgh-metadata crate split	S4 / S6	Nothing to put in them yet

Verify locally

cd server && cargo test && cargo clippy --all-targets -- -D warnings
RUST_BIND=127.0.0.1:3399 cargo run &
curl -s localhost:3399/api/version   # {"current":"0.1.7","latest":null,"release_url":null}

🤖 Generated with Claude Code