Set up workspace skeleton

Five crates: runway-core (pure domain), runway-caldav (protocol),
runway-server (axum), runway-web (leptos), runway-cli (smoke tool).

runway-core is feature-gated into model/ical/recurrence so the frontend
can depend on the shared types without pulling icalendar and rrule into
the WASM bundle. The previous iteration shipped reqwest, ical and regex
to the browser for a dead module; the feature split makes that mistake
structurally hard to repeat.

Guardrails are compiler- and CI-enforced rather than aspirational:
workspace lints deny unwrap_used/expect_used, dead_code and unsafe_code,
clippy.toml caps function length and arity, deny.toml pins licences.

Toolchain is pinned per-project so the machine-wide default is untouched.
Cargo.lock is committed this time.

docs/legacy-audit.md carries the marked-up feature decisions and is the
spec for the rewrite.

Cargo.toml

@@ -0,0 +1,68 @@
+[workspace]
+resolver = "3"
+members = [
+    "crates/runway-core",
+    "crates/runway-caldav",
+    "crates/runway-server",
+    "crates/runway-web",
+    "crates/runway-cli",
+]
+
+[workspace.package]
+version = "0.1.0"
+edition = "2024"
+license = "MIT"
+repository = "https://github.com/connorjohnstone/runway"
+
+[workspace.lints.rust]
+dead_code = "deny"
+unused_must_use = "deny"
+unsafe_code = "forbid"
+
+[workspace.lints.clippy]
+# v1 had 65 of these. Tests opt out locally.
+unwrap_used = "deny"
+expect_used = "deny"
+
+[workspace.dependencies]
+# Internal
+runway-core = { path = "crates/runway-core" }
+runway-caldav = { path = "crates/runway-caldav" }
+
+# Core data
+chrono = { version = "0.4", default-features = false, features = ["serde", "clock", "std"] }
+chrono-tz = { version = "0.10", features = ["serde"] }
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+uuid = { version = "1", features = ["v4", "serde"] }
+
+# Calendar domain
+icalendar = "0.17"
+rrule = "0.14"
+
+# Errors + logging
+thiserror = "2"
+tracing = "0.1"
+tracing-subscriber = { version = "0.3", features = ["env-filter"] }
+
+# Backend
+axum = "0.8"
+tokio = { version = "1", features = ["rt-multi-thread", "macros", "net", "signal"] }
+tower = "0.5"
+tower-http = { version = "0.6", features = ["cors", "trace"] }
+sqlx = { version = "0.9", features = ["runtime-tokio", "sqlite", "chrono", "uuid", "migrate"] }
+reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls"] }
+quick-xml = "0.42"
+
+# Frontend
+leptos = "0.8"
+leptos_router = "0.8"
+
+# Dev
+pretty_assertions = "1"
+
+[profile.release]
+opt-level = "z"
+lto = true
+codegen-units = 1
+strip = true