refactor(infra): Phase 4c — bump zip 2 → 8 (server export)

[Detair]

Summary

Phase 4c of the dep-update sweep (spec, plan). Builds on Phase 4a (#552).

zip rewrote its 2.x → 3.x API but preserved the surface we use (SimpleFileOptions, ZipWriter::new, start_file, finish), so the bump is zero source-change.

Workspace dep

- zip = { version = "2", default-features = false, features = ["deflate"] }
+ zip = { version = "8", default-features = false, features = ["deflate-flate2"] }

Feature rename

zip 8 split the old deflate umbrella into deflate-flate2 (matches our prior behavior — flate2-based deflate with miniz_oxide) and deflate-zopfli (slow, output-optimal compression). We pick deflate-flate2 to preserve write performance for the data-export endpoint.

Single consumer

server/src/governance/export.rs (GDPR data export ZIP archive). 14 start_file calls + finish(). Round-trip behavior is covered by the existing test_request_data_export_no_s3 integration test.

Test plan

• cargo fmt --check — clean
• cargo clippy --tests -p vc-server -- -D warnings — clean
• cargo deny check — advisories ok, bans ok, licenses ok, sources ok
• cargo audit — exit 0 with established ignore list
• cargo build --tests -p vc-server — clean
• cargo check -p vc-server after rebase onto main — clean
• test_request_data_export_no_s3 integration test — runs in CI (DB-dependent, can't run locally)

🤖 Generated with Claude Code