chore(deps): replace tzdata with tz to drop hackney

[zorn]

Summary

Replaces tzdata with tz as Flick's timezone database. This removes hackney from the dependency tree entirely — tzdata was its only non-optional dependent — which clears the four open hackney 1.25.0 advisories that mix hex.audit flagged (CVE-2026-47069/47071/47075/47076). mix hex.audit now reports no advisories at all.

tz compiles the IANA timezone data into the build at compile time, so there is no runtime HTTP client and no data-download-to-disk. It is the correctness-focused, actively maintained alternative that Elixir's own DateTime docs link to. Its one tradeoff versus tzdata — new IANA releases require a recompile/redeploy rather than a live download — is a non-issue for a web app that redeploys regularly, and arguably a plus (deterministic data, no writable data dir).

Changes

• mix.exs: {:tzdata, "~> 1.1"} → {:tz, "~> 0.28"}
• config/config.exs: config :elixir, :time_zone_database, Tzdata.TimeZoneDatabase → Tz.TimeZoneDatabase
• mix.lock: drops tzdata, hackney, and hackney's exclusive deps (certifi, metrics, mimerl, parse_trans, ssl_verify_fun); adds tz

No application code changed. Flick.DateTimeFormatter uses DateTime.shift_zone/2 and Calendar.strftime/2, which read whatever :time_zone_database is configured, so the backend swap is transparent to them.

Verification

• mix precommit passes (108 tests, Credo clean)
• mix hex.audit reports no retired or security-advisory packages
• Live check: DateTime.shift_zone/2 resolves America/New_York (EDT) and Australia/Sydney (AEST) correctly, and returns {:error, :time_zone_not_found} for an unknown zone, with Calendar.get_time_zone_database/0 reporting Tz.TimeZoneDatabase

Note

tz has an optional Tz.UpdatePeriodically supervisor for live IANA updates, which uses mint (not hackney). It is not wired up here — we take timezone data at compile time and refresh it on redeploy.