feat(rust): ping-collector, phase 1 of the Rust rewrite

rust/collector replaces the collection half of the Python web app: RID hourly
gauges (with the late-report semantics: store everything, retry every 10 min
while RID is behind, re-fetch yesterday's holes, startup gap fill), HII rain +
water level, RID dams (today + yesterday) and Open-Meteo rain. Same tables and
upsert semantics, one UNNEST statement per table, Bangkok wall-clock time
regardless of the server time zone.

Python side: COLLECTION_ENABLED=false makes the API leader stop collecting and
instead re-forecast + notify when the newest RID reading in the database
advances (polled every FORECAST_POLL_SECONDS) and once per clock hour;
/scraping/status then serves the collector's status file; /scrape/trigger
answers 409.

Verified: 20 Rust tests (parsers, gap/schedule logic, database tests against
PostgreSQL); live parity run of both collectors into two empty databases:
all 9 tables row-for-row identical (scripts/collector_parity.py); the Python
API served health, measurements, stats, status and model forecasts from a
database filled only by ping-collector. 177 Python tests pass.

reqwest uses native-tls: app.rid.go.th offers only TLS 1.2 CBC suites, which
rustls refuses.

Deploy/cutover/rollback: scripts/install_collector.sh, scripts/ping-collector.service;
CI: .gitea/workflows/rust.yml (fmt, clippy, tests with a PostgreSQL service,
release artifact).

.gitea/workflows/rust.yml

@@ -0,0 +1,71 @@
+name: Rust
+
+# rust/ workspace (ping-collector): format, clippy, tests (including the
+# database tests against a throwaway PostgreSQL service), release build.
+# The Linux binary is uploaded as an artifact for scripts/install_collector.sh.
+
+on:
+  push:
+    branches: [master, develop]
+    paths:
+      - "rust/**"
+      - "src/data/stations.json"
+      - ".gitea/workflows/rust.yml"
+  pull_request:
+    branches: [master]
+    paths:
+      - "rust/**"
+      - "src/data/stations.json"
+      - ".gitea/workflows/rust.yml"
+  workflow_dispatch:
+
+jobs:
+  rust:
+    name: fmt, clippy, test, build
+    runs-on: ubuntu-latest
+    services:
+      postgres:
+        image: postgres:16
+        env:
+          POSTGRES_PASSWORD: ping
+          POSTGRES_DB: ping
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 20
+    env:
+      CARGO_TERM_COLOR: always
+      TEST_DATABASE_URL: postgres://postgres:ping@postgres:5432/ping
+    defaults:
+      run:
+        working-directory: rust
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: System packages (OpenSSL headers for native-tls)
+        run: |
+          SUDO=$(command -v sudo || true)
+          $SUDO apt-get update -qq
+          $SUDO apt-get install -y -qq pkg-config libssl-dev
+
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: rustfmt, clippy
+
+      - name: fmt
+        run: cargo fmt --all --check
+
+      - name: clippy
+        run: cargo clippy --all-targets --locked -- -D warnings
+
+      - name: test
+        run: cargo test --locked
+
+      - name: release build
+        run: cargo build --release --locked
+
+      - uses: actions/upload-artifact@v3
+        with:
+          name: ping-collector-linux-x86_64
+          path: rust/target/release/ping-collector