Keep History's errors when the tab refreshes, and bump rustls

[AndersRobstad]

Main's CI has been red since #99/#100: check and e2e and dependency audit both fail at db1c52d. This fixes both, so #101 (and the release after it) can go out on a green pipeline.

History errors vanished when the tab opened

#99 made History catch up whenever the tab is opened. refresh() set this.error = null after any list that succeeded, which also wiped a failed body load or a failed clear before the tab that reports them could show it. The two e2e tests covering that fail on main:

• a body-load failure is reported without taking history down
• a failed per-request clear restores the response

History now remembers the message of the last failed list, and a list that succeeds clears that message and nothing else. a transient history-body error clears after reopening succeeds still passes.

RUSTSEC-2026-0285

cargo audit fails on rustls 0.23.43 (TLS 1.3 handshake messages accepted across encryption level boundaries; fixed in ≥ 0.23.45). cargo update -p rustls moves only that crate to 0.23.45. rustls is the TLS stack of the MCP image, so this is worth shipping in the same release.

fast-uri

With cargo audit passing, the next step of the same job, pnpm audit --prod --audit-level high, fails on fast-uri 3.1.6 (via ajv): GHSA-qw65-cvwx-89v3 and GHSA-58mr-gqgx-xq4g. pnpm update fast-uri --depth Infinity moves it to 3.1.8, which is inside ajv's ^3.0.1; nothing else in the lockfile changes. The audit then reports one low finding and passes.

A flaky settings-drawer test

After the audit went green, opening another collection’s settings flushes the one being left failed on this PR, first try and retry. It is flaky on main too: 4 of 40 local runs failed with main's code. Clicking another collection's cog is also a click outside the open drawer, so it both dismissed the drawer and started opening the next one. When the dismissal landed last, no drawer stayed open. The drawer now ignores outside interactions on a cog (data-opens-settings), since the cog switches collections itself and flushes the one being left. 60/60 local runs pass.

Verification

Locally: pnpm check is clean and the full Playwright suite passes (339/339) with every change here, and json-schema.spec.ts again after the fast-uri bump.