Cache the cargo build in CI

Tauri's dependency tree was recompiled from scratch every run, which was
the whole 19 minutes. Separate cache keys per profile, pointed at
src-tauri where the crate actually lives. Pull requests restore but do
not save, so a branch cannot evict main's entry.

Author: Topurrra

.github/workflows/ci.yml

@@ -19,6 +19,19 @@ jobs:
           toolchain: stable
           components: clippy, rustfmt
 
+      # The crate lives in src-tauri, not the repo root, so point the cache at it
+      # or it finds no Cargo.lock and silently caches nothing. Tauri pulls a large
+      # dependency tree and compiling it from scratch was the whole 19 minutes.
+      # The key is separate from the release job's: this one holds dev profile
+      # artifacts, that one holds the optimized profile, and they do not overlap.
+      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2.9.1
+        with:
+          workspaces: src-tauri
+          shared-key: ci-dev
+          # Pull requests restore the cache but do not write one, so a branch
+          # cannot evict main's entry with its own half built tree.
+          save-if: ${{ github.ref == 'refs/heads/main' }}
+
       # No setup-node: windows-latest already ships a Node new enough for Vite
       # and for the node --test style suites, so this is one less action to pin.
       - name: Frontend

.github/workflows/release.yml

@@ -20,6 +20,16 @@ jobs:
           toolchain: stable
           components: clippy, rustfmt
 
+      # A separate key from CI's on purpose: this job compiles the optimized
+      # profile with lto and opt-level z, so it shares almost no artifacts with
+      # the dev profile CI caches. Tags are infrequent, but dependencies change
+      # far less often than tags do, so the entry usually survives release to
+      # release. Always saves: there is no branch here to protect main from.
+      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2.9.1
+        with:
+          workspaces: src-tauri
+          shared-key: release-opt
+
       # Without the signing key the build still produces an installer, then fails
       # at the very end when it cannot write the updater signature. That wastes a
       # full Tauri release build, so refuse up front with a message that says what