Document dependency consolidation candidates

[Finesssee]

Summary

• document an evidence-driven dependency consolidation strategy in ADR 0006
• rank high-confidence candidates (strum, ts-rs, serde_with, url, parking_lot, itertools, bon, serde_path_to_error)
• keep architecture-specific crates behind focused prototypes (tokio-util, secrecy, moka, HTTP middleware/retry, rust_decimal, phf)
• require each dependency PR to delete or centralize measured existing code instead of adding dormant crates

Audit evidence

• ProviderId: 70 variants; rust/src/core/provider.rs: 1,131 LOC
• frontend bridge: 958 LOC / 101 exported types and interfaces
• Tauri invoke wrapper: 534 LOC / 91 wrappers; backend exposes 98 commands
• FetchContext: 26 manual construction sites
• about 20 lock().unwrap* sites, including 8 explicit poison-recovery paths

Validation

• rebased onto the latest port/upstream-0.56.0 before commit
• re-ran the measured audit counts after the rebase
• git diff --check passed
• docs-only change; no runtime dependency, source, lockfile, or UI behavior changed

This ADR stays Proposed so review can reject or reorder individual candidates before any implementation PR lands.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Team

Run ID: 5bbe6b6b-2b15-4815-a5d7-51e0a5e394f5

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[Finesssee]

Thermo-nuclear review: APPROVE AS A PROPOSED ADR

No code-quality blocker. This is documentation only and, importantly, it does not authorize dependency accumulation: every candidate is gated on deleting/centralizing measured code, Tier 2 requires a concrete problem/prototype, and the ADR remains Proposed. That is consistent with the repo rule that tooling/dependency additions require explicit confirmation.

Process note: the PR targets the older port/upstream-0.56.0 line rather than the active rebuilt review/upstream-0.56.0 review train. Retarget if the ADR is intended to land with the current branch sequence.

No runtime code, 1,000-line threshold, or CUA issue applies.