ci: enforce clippy -D warnings and cargo audit as hard gates

Flip both CI gates from informational to hard-fail (SPEC-001 quality gates):
- clippy: `-- -D warnings` on the server crate. Cleared the debt via clippy --fix
  (unused imports/style), targeted #[allow(dead_code)] on native-remote-control
  future API, and #[allow(clippy::too_many_arguments)] on 3 protocol-mirroring fns.
- cargo audit: hard-fail with documented per-ID --ignore flags (rsa RUSTSEC-2023-0071
  unfixable/unreachable in active tree; gtk-rs + glib Linux-only tray backend not
  compiled into the Windows agent; proc-macro-error build-time). New advisories fail.
- Move [profile.release] to the workspace root (it was silently ignored in the server
  member), activating lto/codegen-units/strip.

No behavioral changes. Reviewed and gates verified passing on the build host.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

server/src/support_codes.rs

@@ -36,6 +36,8 @@ pub enum CodeStatus {
 /// Request to create a new support code
 #[derive(Debug, Deserialize)]
 pub struct CreateCodeRequest {
+    #[allow(dead_code)]
+    // TODO(native-remote-control): consumed by the integration API; see docs/specs/native-remote-control/
     pub technician_id: Option<String>,
     pub technician_name: Option<String>,
 }
@@ -172,6 +174,7 @@ impl SupportCodeManager {
     }
 
     /// Get code by its code string
+    #[allow(dead_code)] // TODO(native-remote-control): consumed by the integration API; see docs/specs/native-remote-control/
     pub async fn get_code(&self, code: &str) -> Option<SupportCode> {
         let codes = self.codes.read().await;
         codes.get(code).cloned()
@@ -209,6 +212,7 @@ impl SupportCodeManager {
     }
 
     /// Check if a code is valid for connection (exists and is pending)
+    #[allow(dead_code)] // TODO(native-remote-control): consumed by the integration API; see docs/specs/native-remote-control/
     pub async fn is_valid_for_connection(&self, code: &str) -> bool {
         let codes = self.codes.read().await;
         codes
@@ -218,6 +222,7 @@ impl SupportCodeManager {
     }
 
     /// List all codes (for dashboard)
+    #[allow(dead_code)] // TODO(native-remote-control): consumed by the integration API; see docs/specs/native-remote-control/
     pub async fn list_codes(&self) -> Vec<SupportCode> {
         let codes = self.codes.read().await;
         codes.values().cloned().collect()
@@ -234,6 +239,7 @@ impl SupportCodeManager {
     }
 
     /// Get code by session ID
+    #[allow(dead_code)] // TODO(native-remote-control): consumed by the integration API; see docs/specs/native-remote-control/
     pub async fn get_by_session(&self, session_id: Uuid) -> Option<SupportCode> {
         let session_to_code = self.session_to_code.read().await;
         let code = session_to_code.get(&session_id)?;