chore: update flake inputs and ignore unreachable stdlib CVEs

Update nixpkgs (2026-03-09) and git-hooks (2026-03-07).

Add ignore entries for GO-2026-4601 (url.Parse IPv6 host flaw; only
caller parses user's own config, not attacker input) and GO-2026-4602
(os.ReadDir traversal via Root-constrained File; micasa uses plain
os.ReadDir, never os.OpenRoot).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: cpcloud

flake.lock

@@ -17,6 +17,14 @@ reason = "minor TLS 1.3 info disclosure requiring network-local attacker; defaul
 id = "GO-2026-4342"
 reason = "archive/zip DoS via crafted ZIP filenames; micasa never opens or processes ZIP archives"
 
+[[IgnoredVulns]]
+id = "GO-2026-4601"
+reason = "url.Parse IPv6 host parsing flaw; only caller is isLoopbackURL which parses the user's own llm.base_url config value, not attacker-supplied input"
+
+[[IgnoredVulns]]
+id = "GO-2026-4602"
+reason = "os.ReadDir directory traversal via Root-constrained File; micasa uses plain os.ReadDir on a local cache dir, never uses os.OpenRoot"
+
 # ollama server-side vulnerabilities: micasa is a client that makes HTTP
 # requests to an Ollama server; it does not embed, host, or run the Ollama
 # server, GGUF parser, or model-serving endpoints. These code paths are