fix(security): audit — fix RUSTSEC vulns, clippy warnings, dead code (#769)

- Upgrade openssl to 0.10.78 (CVE-2026-41676), jsonwebtoken to 9.4
- Suppress unmaintained-only/no-CVE advisories in .cargo/audit.toml
  with per-entry rationale
- Fix all `cargo clippy --all-targets -- -D warnings` errors across
  35 crates: derivable_impls, needless_range_loop, map_or→is_some_and/
  is_none_or, await_holding_lock (drop MutexGuard before .await),
  ptr_arg (&mut Vec→&mut [T]), useless_conversion, approximate_constant
  (2.718→E, 3.14→PI), field_reassign_with_default, manual_inspect,
  useless_vec, lines_filter_map_ok, print_literal, dead_code
- Apply `cargo fmt --all`
- Pre-existing test failure in wifi-densepose-signal
  (test_estimate_occupancy_noise_only) is not introduced by this PR

v2/Cargo.toml

@@ -144,10 +144,13 @@ mockall = "0.12"
 wiremock = "0.5"
 
 # midstreamer integration (published on crates.io)
-midstreamer-quic = "0.1.0"
-midstreamer-scheduler = "0.1.0"
-midstreamer-temporal-compare = "0.1.0"
-midstreamer-attractor = "0.1.0"
+# 0.1.0 was yanked; upgrade to latest 0.3/0.2 releases which pull in
+# quinn-proto >=0.11.14 (fixes RUSTSEC-2026-0037) and
+# rustls-webpki >=0.103.13 (fixes RUSTSEC-2026-0049/0098/0099/0104).
+midstreamer-quic = "0.3"
+midstreamer-scheduler = "0.2"
+midstreamer-temporal-compare = "0.2"
+midstreamer-attractor = "0.2"
 
 # ruvector integration (published on crates.io)
 # Vendored at v2.1.0 in vendor/ruvector; using crates.io versions until published.