ci: enforce clippy -D warnings and cargo audit as hard gates

Flip both CI gates from informational to hard-fail (SPEC-001 quality gates):
- clippy: `-- -D warnings` on the server crate. Cleared the debt via clippy --fix
  (unused imports/style), targeted #[allow(dead_code)] on native-remote-control
  future API, and #[allow(clippy::too_many_arguments)] on 3 protocol-mirroring fns.
- cargo audit: hard-fail with documented per-ID --ignore flags (rsa RUSTSEC-2023-0071
  unfixable/unreachable in active tree; gtk-rs + glib Linux-only tray backend not
  compiled into the Windows agent; proc-macro-error build-time). New advisories fail.
- Move [profile.release] to the workspace root (it was silently ignored in the server
  member), activating lto/codegen-units/strip.

No behavioral changes. Reviewed and gates verified passing on the build host.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

server/src/main.rs

@@ -31,7 +31,7 @@ use axum::{
 use serde::Deserialize;
 use std::net::SocketAddr;
 use std::sync::Arc;
-use tower_http::cors::{AllowOrigin, Any, CorsLayer};
+use tower_http::cors::CorsLayer;
 use tower_http::services::ServeDir;
 use tower_http::trace::TraceLayer;
 use tracing::{info, Level};
@@ -76,7 +76,7 @@ async fn auth_layer(
 #[tokio::main]
 async fn main() -> Result<()> {
     // Initialize logging
-    let _subscriber = FmtSubscriber::builder()
+    FmtSubscriber::builder()
         .with_max_level(Level::INFO)
         .with_target(true)
         .init();
@@ -359,7 +359,7 @@ async fn main() -> Result<()> {
         .layer(TraceLayer::new_for_http())
         // SEC-11: Restricted CORS configuration
         .layer({
-            let cors = CorsLayer::new()
+            CorsLayer::new()
                 // Allow requests from the production domain and localhost (for development)
                 .allow_origin([
                     "https://connect.azcomputerguru.com"
@@ -383,8 +383,7 @@ async fn main() -> Result<()> {
                     axum::http::header::ACCEPT,
                 ])
                 // Allow credentials (cookies, auth headers)
-                .allow_credentials(true);
-            cors
+                .allow_credentials(true)
         });
 
     // Start server
@@ -437,6 +436,7 @@ async fn list_codes(
 }
 
 #[derive(Deserialize)]
+#[allow(dead_code)] // TODO(native-remote-control): consumed by the integration API; see docs/specs/native-remote-control/
 struct ValidateParams {
     code: String,
 }