ci: enforce clippy -D warnings and cargo audit as hard gates

Flip both CI gates from informational to hard-fail (SPEC-001 quality gates):
- clippy: `-- -D warnings` on the server crate. Cleared the debt via clippy --fix
  (unused imports/style), targeted #[allow(dead_code)] on native-remote-control
  future API, and #[allow(clippy::too_many_arguments)] on 3 protocol-mirroring fns.
- cargo audit: hard-fail with documented per-ID --ignore flags (rsa RUSTSEC-2023-0071
  unfixable/unreachable in active tree; gtk-rs + glib Linux-only tray backend not
  compiled into the Windows agent; proc-macro-error build-time). New advisories fail.
- Move [profile.release] to the workspace root (it was silently ignored in the server
  member), activating lto/codegen-units/strip.

No behavioral changes. Reviewed and gates verified passing on the build host.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

server/src/auth/mod.rs

@@ -23,11 +23,14 @@ pub struct AuthenticatedUser {
     pub user_id: String,
     pub username: String,
     pub role: String,
+    #[allow(dead_code)]
+    // TODO(native-remote-control): consumed by the integration API; see docs/specs/native-remote-control/
     pub permissions: Vec<String>,
 }
 
 impl AuthenticatedUser {
     /// Check if user has a specific permission
+    #[allow(dead_code)] // TODO(native-remote-control): consumed by the integration API; see docs/specs/native-remote-control/
     pub fn has_permission(&self, permission: &str) -> bool {
         if self.role == "admin" {
             return true;
@@ -54,6 +57,7 @@ impl From<Claims> for AuthenticatedUser {
 
 /// Authenticated agent from API key
 #[derive(Debug, Clone)]
+#[allow(dead_code)] // TODO(native-remote-control): consumed by the integration API; see docs/specs/native-remote-control/
 pub struct AuthenticatedAgent {
     pub agent_id: String,
     pub org_id: String,
@@ -61,11 +65,13 @@ pub struct AuthenticatedAgent {
 
 /// JWT configuration stored in app state
 #[derive(Clone)]
+#[allow(dead_code)] // TODO(native-remote-control): consumed by the integration API; see docs/specs/native-remote-control/
 pub struct AuthState {
     pub jwt_config: Arc<JwtConfig>,
 }
 
 impl AuthState {
+    #[allow(dead_code)] // TODO(native-remote-control): consumed by the integration API; see docs/specs/native-remote-control/
     pub fn new(jwt_secret: String, expiry_hours: i64) -> Self {
         Self {
             jwt_config: Arc::new(JwtConfig::new(jwt_secret, expiry_hours)),
@@ -122,6 +128,7 @@ where
 
 /// Optional authenticated user (doesn't reject if not authenticated)
 #[derive(Debug, Clone)]
+#[allow(dead_code)] // TODO(native-remote-control): consumed by the integration API; see docs/specs/native-remote-control/
 pub struct OptionalUser(pub Option<AuthenticatedUser>);
 
 #[axum::async_trait]
@@ -161,6 +168,7 @@ where
 }
 
 /// Validate an agent API key (placeholder for MVP)
+#[allow(dead_code)] // TODO(native-remote-control): consumed by the integration API; see docs/specs/native-remote-control/
 pub fn validate_agent_key(_api_key: &str) -> Option<AuthenticatedAgent> {
     // TODO: Implement actual API key validation against database
     // For now, accept any key for agent connections