Bug Fixes

• deliveries: outside platform mode, a caller reads only its own tenant's deliveries (fd6b621)
• metrics: serve the service's own metrics on /metrics, so its alerts can fire (21eeea3)
• reports: fetch the expense-report PDF with the token reporting-api accepts (3fa2bbc)
• templates: a tenant template can no longer crash the service; cap template size (a6806c0)
• templates: tenant-written email HTML is sanitised; one plain recipient per order email (d8ef5f1)
• deps: move to sea-orm 2.0 and sqlx 0.9, which takes rsa out of the lockfile (42021dc)
• deps: clear the October RustSec advisories (9babc2c), closes PKCS#8
• deps: replace backoff with a local retry helper (09003f6)