refactor: use zat.AtUri.format in tap.zig

- update zat dependency to get extractAt fix (ignore_unknown_fields)
- replace std.fmt.allocPrint with zat.AtUri.format for AT-URI construction
- avoids allocation by using stack buffer

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <[e-mail]>

backend/build.zig.zon

···
         },
         .zat = .{
             .url = "https://tangled.sh/zat.dev/zat/archive/main",
-            .hash = "zat-0.1.0-5PuC7jCDAQALUWX2KlMvtxPfiUvfvv_pUQfloalBnQkA",
+            .hash = "zat-0.1.0-5PuC7heIAQA4j2UVmJT-oivQh5AwZTrFQ-NC4CJi2-_R",
         },
     },
     .paths = .{

backend/src/tap.zig

···
     // validate DID
     const did = zat.Did.parse(rec.did) orelse return;
 
-    // build AT-URI string
-    const uri = try std.fmt.allocPrint(allocator, "at://{s}/{s}/{s}", .{ did.raw, rec.collection, rec.rkey });
-    defer allocator.free(uri);
+    // build AT-URI string (no allocation - uses stack buffer)
+    var uri_buf: [256]u8 = undefined;
+    const uri = zat.AtUri.format(&uri_buf, did.raw, rec.collection, rec.rkey) orelse return;
 
     if (rec.isCreate() or rec.isUpdate()) {
         const inner_record = zat.json.getObject(parsed.value, "record.record") orelse return;