chore: remove unused irma dependency

CLAUDE.md

@@ -41,6 +41,16 @@ Release-plz automation.
   running". Use `#[rocket::async_test]` and `async fn`, even when the body never
   awaits.
 
+## Dependencies
+- cryptify has no IRMA/Yivi client of its own. Attributes arrive already signed
+  inside the PostGuard-sealed file and are read back through `pg-core`'s Unsealer,
+  so nothing here talks to a Yivi session server.
+- `pg-core` depends on the `irma` crate, so `irma` 0.2.1 is still compiled into the
+  binary even though cryptify does not declare it (`cargo tree -i irma`). It drags
+  in `reqwest` 0.11.27 too, alongside cryptify's own `reqwest` 0.13.4. Dropping the
+  direct declaration does not take `irma` out of the build; check `Cargo.toml` to
+  tell direct from transitive.
+
 ## Running the binary
 - Needs a reachable PKG server (`pkg_url`) at startup or it panics on
   `/v2/sign/parameters`. For config tests, prefer a serde-roundtrip unit test over

Cargo.toml

@@ -11,7 +11,6 @@ description = "End-to-end encrypted file sharing service"
 [dependencies]
 askama = "0.16.0"
 chrono = { version = "0.4.45", features = ["unstable-locales"] }
-irma = "0.2.1"
 lettre = "0.11.22"
 log = "0.4.33"
 rand = "0.10.1"