deps: modernc.org/sqlite 1.60.1, x/crypto 0.58.0, x/sys 0.49.0 (audit stage 0)

- go get ...@latest + go mod tidy: sqlite 1.53.0 -> 1.60.1 (libc
  1.77.1, memory 1.12.1), x/crypto 0.54.0 -> 0.58.0, x/sys 0.47.0 ->
  0.49.0, go-isatty 0.0.24. The go line reads 1.26.0 (tidy's spelling of
  1.26); no dependency asks for a newer Go.
- development.md: golang:1.26-bookworm floats to the newest patch, and
  the standard library's security fixes arrive that way - rebuild the image
  after each Go patch release; dependencies are raised by hand.
- CHANGELOG [Unreleased], audit plan line ticked, roadmap 5/61.

Evidence on the test server (Go 1.26.5) for this tree plus the next
commit's staticcheck fixes: go vet clean, go test ./... 23 packages ok,
make e2e exit 0.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -23,6 +23,12 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
   now say so and show how to build the image locally under the pinned name,
   which Compose and `docker run` then use without pulling (audit 2026-10-12,
   M6). The pin stays: the next publication makes it true.
+- **Dependencies raised**: `modernc.org/sqlite` 1.53.0 → 1.60.1 (with
+  `modernc.org/libc` 1.77.1), `golang.org/x/crypto` 0.54.0 → 0.58.0,
+  `golang.org/x/sys` 0.47.0 → 0.49.0. The three published `x/crypto` fixes
+  were in code SelfPost does not call (audit 2026-10-12). development.md says
+  the image is rebuilt after each Go patch release, which is where the
+  standard library's security fixes come from.
 - **The e2e module is compiled on every push** (`test.yml`: `go vet` and
   `go test -c` in `test/e2e`), so a type error there no longer first shows
   up in `release.yml` after a release is published (audit 2026-10-12, M20).