chore(clippy): bring cargo clippy to zero warnings and enforce -D warnings in CI

[prefrontalsys]

Summary

Follow-up to #200 and #202. Brings cargo clippy --lib --tests --all-features -- -D warnings from 243 warnings to 0, then flips the CI Clippy job from continue-on-error: true to an enforcing gate, and adds --lib --tests so test-target lint debt can't accumulate invisibly.

No behavior change. All 2021 lib tests pass before and after.

Evidence

Baseline (upstream/main @ 63671e3, cargo clippy --lib --tests --all-features):

• lib: 123 warnings
• lib test: 120 warnings (70 duplicates)

Post-PR: 0 warnings, 0 errors.

Shape

9 commits, one category per commit, to make review bisectable:

1. relocate cfg(test)-gated imports — EnvPlaceholder and DEFAULT_MCP_SERVER_PORT were imported at module level but only used inside #[cfg(test)] blocks. Moving them into the test modules eliminates the warning without risking a cargo clippy --fix regression that would strip them and break test compile.
2. prefix unused variables with _ — 10 sites across 6 files.
3. replace useless vec! with arrays — 28 sites.
4. resolve dead-code warnings via targeted allows — 66 warnings broken into four sub-patterns: 45 pub(crate) test-helpers (#[cfg_attr(not(test), allow(dead_code))]); 4 vestigial vendor enums + 8 variant structs (#[allow(dead_code)] + a comment noting they are reserved for a typed parse path that the Parsed*Mcp normalization currently supersedes); 4 serde-deser false positives + 3 fields; one genuine deletion (Database::from_connection, already #[cfg(test)]-gated with no callers).
5. apply mechanical autofix suggestions — manual Option::map, assert_eq!(x, true), Iterator::last → next_back(), map().flatten() → and_then, redundant closures, useless format!, etc. Also replaces a tautological assert!(enabled == true || enabled == false) in debug_logger.rs with let _ = is_debug_enabled(); matching the adjacent test's pattern — the assertion was already always-true before the rewrite, and the newer nonminimal_bool lint now flags the explicit form.
6. accept &Path instead of &PathBuf — 10 helper signatures; callers already pass &PathBuf which auto-derefs to &Path.
7. allow type_complexity on DB-row-tuple helpers — 7 fns where the 7–10-field rusqlite row tuple IS the domain shape; a named alias would just duplicate the tuple. Matches how the existing McpTuple aliases in services/*_config.rs are scoped.
8. long-tail cleanup — module_inception on commands::commands, manual_async_fn on the rmcp ServerHandler impl (trait uses impl Future return), strip_prefix(\"---\") in parse_frontmatter, too_many_arguments on get_or_create_mcp(9), fm.contains_key(...) over fm.get(...).is_none(), non_snake_case allow on test_parse_skill_file_with_allowedTools_camelCase where the camelCase mirrors the schema field under test.
9. ci: enforce -D warnings on lib + tests — drops continue-on-error: true, adds --lib --tests to the Clippy step.

Not in scope

• clippy.toml / [lints.clippy] in Cargo.toml. The repo currently has no crate-level clippy config; adding one is a separate decision about baseline hardening.
• Enabling lint groups beyond the default set (e.g. -W clippy::pedantic, -W clippy::nursery).
• Matrix-ing Clippy across ubuntu/macos/windows; CI still runs it on ubuntu-only, which is sufficient for Rust-level lints.

Caveats

• Fork-PR build-job failures expected (ubuntu + macos×2 + windows build jobs). Same pattern as Fix: append .bak extension instead of replacing file extension #199/fix: scan rules from disk + dedup flat-md scanners #200/fix: writers emit tags as JSON array frontmatter (skill/command/subagent) #202: TAURI_SIGNING_PRIVATE_KEY_PASSWORD isn't available to workflows from fork PRs; the Rust code compiles, only updater-bundle signing fails. The code-exercising checks (Rust Tests ubuntu/macos/windows, Clippy, Format, frontend-tests) should be green.
• cargo clippy --fix applies both clippy lints AND rustc built-in lints (including unused_imports). Scoping with -A clippy::all -W clippy::useless_vec does NOT gate the rustc lints. This is why commit 1 (cfg(test)-import relocation) had to land before broader autofix runs — otherwise EnvPlaceholder and DEFAULT_MCP_SERVER_PORT would have been stripped, silently breaking test compile. Worth knowing for future cleanup PRs.

Relation to prior work

• post fix: scan rules from disk + dedup flat-md scanners #200 (scan rules + dedup flat-md scanners)
• post fix: writers emit tags as JSON array frontmatter (skill/command/subagent) #202 (writers emit tags as JSON array)
• unblocks: vendor scanner dedup, settings.local.json hook scanning, refresh-button rescan

Test plan

• cargo fmt --check — passes
• cargo clippy --lib --tests --all-features -- -D warnings — exit 0
• cargo test --lib --all-features — 2021 passed, 0 failed
• cargo test --all-features — full suite, all green
• Local diff review: changes confined to src-tauri/src/** and .github/workflows/rust-tests.yml