Update backend to v0.3.6

[tripledoublev]

Summary

• update save-dweb-backend to v0.3.6, Veilid to v0.5.3, and save-rust to v0.2.3
• keep the save-rust app-facing public interface unchanged; Android JNI symbols, server entry points, route paths, and request/response structs are not intentionally changed
• avoid blocking group refresh on local writable repos by listing those files locally instead of attempting peer download
• run cargo fmt across the branch

Public interface check

• Cargo files carry the version/lockfile updates
• source diffs outside src/groups.rs are formatting-only from cargo fmt
• the whitespace-ignored functional source diff remains limited to the internal refresh_group logic in src/groups.rs

Validation

• cargo fmt --check
• cargo check
• cargo test --no-run
• cargo clippy --all-targets --all-features -- -D warnings