feat: enforce bounded API-only Grocy transport

Cargo.toml

@@ -0,0 +1,38 @@
+[package]
+name = "hermes-grocy-mcp"
+version = "0.1.0"
+edition = "2024"
+license = "AGPL-3.0-only"
+description = "Protected local Grocy MCP for household data"
+
+[dependencies]
+rmcp = { version = "1.5", features = ["server", "transport-io"] }
+tokio = { version = "1", features = ["rt-multi-thread", "macros", "io-std", "sync", "time", "process"] }
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+schemars = "1"
+reqwest = { version = "0.13", default-features = false, features = ["rustls", "json", "stream", "query"] }
+url = "2"
+rust_decimal = { version = "1", features = ["serde"] }
+secrecy = "0.10"
+zeroize = "1"
+clap = { version = "4", features = ["derive"] }
+dialoguer = "0.12"
+base64 = "0.22"
+libsecret = { version = "0.9", features = ["v0_19"] }
+gio = "0.22"
+glib = "0.22"
+futures-util = "0.3"
+libc = "0.2"
+chrono = "0.4"
+
+[dev-dependencies]
+axum = "0.8"
+tokio = { version = "1", features = ["net", "io-util"] }
+tempfile = "3"
+rmcp = { version = "1.5", features = ["client"] }
+zbus = { version = "5", default-features = false, features = ["tokio"] }
+
+[profile.release]
+lto = "thin"
+strip = true