ci: enforce clippy -D warnings and cargo audit as hard gates

Flip both CI gates from informational to hard-fail (SPEC-001 quality gates):
- clippy: `-- -D warnings` on the server crate. Cleared the debt via clippy --fix
  (unused imports/style), targeted #[allow(dead_code)] on native-remote-control
  future API, and #[allow(clippy::too_many_arguments)] on 3 protocol-mirroring fns.
- cargo audit: hard-fail with documented per-ID --ignore flags (rsa RUSTSEC-2023-0071
  unfixable/unreachable in active tree; gtk-rs + glib Linux-only tray backend not
  compiled into the Windows agent; proc-macro-error build-time). New advisories fail.
- Move [profile.release] to the workspace root (it was silently ignored in the server
  member), activating lto/codegen-units/strip.

No behavioral changes. Reviewed and gates verified passing on the build host.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

server/src/api/auth.rs

@@ -1,13 +1,9 @@
 //! Authentication API endpoints
 
-use axum::{
-    extract::{Request, State},
-    http::StatusCode,
-    Json,
-};
+use axum::{extract::State, http::StatusCode, Json};
 use serde::{Deserialize, Serialize};
 
-use crate::auth::{verify_password, AuthenticatedUser, JwtConfig};
+use crate::auth::{verify_password, AuthenticatedUser};
 use crate::db;
 use crate::AppState;
 

server/src/api/auth_logout.rs

@@ -1,7 +1,7 @@
 //! Logout and token revocation endpoints
 
 use axum::{
-    extract::{Path, Request, State},
+    extract::{Request, State},
     http::{HeaderMap, StatusCode},
     Json,
 };
@@ -97,7 +97,7 @@ pub struct RevokeUserRequest {
 ///
 /// For MVP, we're implementing the foundation but not the full user tracking.
 pub async fn revoke_user_tokens(
-    State(state): State<AppState>,
+    State(_state): State<AppState>,
     admin: AuthenticatedUser,
     Json(req): Json<RevokeUserRequest>,
 ) -> Result<Json<LogoutResponse>, (StatusCode, Json<ErrorResponse>)> {

server/src/api/downloads.rs

@@ -7,13 +7,13 @@
 
 use axum::{
     body::Body,
-    extract::{Path, Query, State},
+    extract::Query,
     http::{header, StatusCode},
     response::{IntoResponse, Response},
 };
 use serde::{Deserialize, Serialize};
 use std::path::PathBuf;
-use tracing::{error, info, warn};
+use tracing::{error, info};
 
 /// Magic marker for embedded configuration (must match agent)
 const MAGIC_MARKER: &[u8] = b"GURUCONFIG";

server/src/api/mod.rs

@@ -8,7 +8,7 @@ pub mod releases;
 pub mod users;
 
 use axum::{
-    extract::{Path, Query, State},
+    extract::{Path, State},
     Json,
 };
 use serde::{Deserialize, Serialize};
@@ -78,12 +78,14 @@ impl From<crate::session::Session> for SessionInfo {
 }
 
 /// List all active sessions
+#[allow(dead_code)] // TODO(native-remote-control): consumed by the integration API; see docs/specs/native-remote-control/
 pub async fn list_sessions(State(sessions): State<SessionManager>) -> Json<Vec<SessionInfo>> {
     let sessions = sessions.list_sessions().await;
     Json(sessions.into_iter().map(SessionInfo::from).collect())
 }
 
 /// Get a specific session by ID
+#[allow(dead_code)] // TODO(native-remote-control): consumed by the integration API; see docs/specs/native-remote-control/
 pub async fn get_session(
     State(sessions): State<SessionManager>,
     Path(id): Path<String>,