chore(swarm): move swarm-nats-auth's deps to the workspace

Per mara on the PR: all deps go into workspace level so versions stay
consistent. async-nats, data-encoding, nkeys and nats-jwt are new
[workspace.dependencies] entries; sha2 and futures-util now come from
there.

The crate had asked for sha2 0.10 while the workspace standard is 0.11,
and for the futures facade where the workspace carries futures-util. Both
resolved without adding a Cargo.lock entry - each was already in the tree
via something else - so the drift was invisible in the lock and would only
have surfaced as two versions of a hashing crate in one binary.

Cargo.toml

@@ -140,5 +140,22 @@ matrix-sdk = { version = "0.18", default-features = false, features = [
 futures-util = "0.3"
 hmac = "0.13"
 sha2 = "0.11"
+# The NATS protocol client, for the swarm queue's auth-callout responder.
+# `default-features = false` because the default set is broad - jetstream, kv,
+# object-store, websockets, service - and a callout responder speaks none of
+# them. What is named is the whole requirement: the server generation we
+# deploy, nkey auth, and a TLS backend.
+async-nats = { version = "0.50", default-features = false, features = [
+  "server_2_14",
+  "nkeys",
+  "ring",
+] }
+data-encoding = "2"
+# The nkey *format* - ed25519 + base32 + CRC16. The primitives are already in
+# the tree; the format is not, and hand-rolling a key format on an auth path
+# is how you get a CRC bug nobody reviews.
+nkeys = "0.4"
+# A TEST ORACLE, not a runtime dependency - see swarm-nats-auth's respond.rs.
+nats-jwt = "0.3"
 utoipa = { version = "5", features = ["axum_extras", "chrono"] }
 utoipa-axum = "0.2"