fix(security): audit — fix RUSTSEC vulns, clippy warnings, dead code (#769)

- Upgrade openssl to 0.10.78 (CVE-2026-41676), jsonwebtoken to 9.4
- Suppress unmaintained-only/no-CVE advisories in .cargo/audit.toml
  with per-entry rationale
- Fix all `cargo clippy --all-targets -- -D warnings` errors across
  35 crates: derivable_impls, needless_range_loop, map_or→is_some_and/
  is_none_or, await_holding_lock (drop MutexGuard before .await),
  ptr_arg (&mut Vec→&mut [T]), useless_conversion, approximate_constant
  (2.718→E, 3.14→PI), field_reassign_with_default, manual_inspect,
  useless_vec, lines_filter_map_ok, print_literal, dead_code
- Apply `cargo fmt --all`
- Pre-existing test failure in wifi-densepose-signal
  (test_estimate_occupancy_noise_only) is not introduced by this PR

v2/crates/nvsim-server/src/main.rs

@@ -135,7 +135,10 @@ struct VerifyBody {
     expected_hex: String,
 }
 
+/// Incoming request body for the `/step` endpoint.
+/// Fields are optional; unused ones are reserved for future extensions.
 #[derive(Deserialize)]
+#[allow(dead_code)]
 struct StepReq {
     direction: Option<String>,
     dt_ms: Option<f64>,
@@ -347,10 +350,7 @@ fn chrono_like_now() -> String {
     format!("{secs}-unix")
 }
 
-async fn ws_handler(
-    ws: WebSocketUpgrade,
-    State(s): State<AppState>,
-) -> impl IntoResponse {
+async fn ws_handler(ws: WebSocketUpgrade, State(s): State<AppState>) -> impl IntoResponse {
     ws.on_upgrade(move |socket| handle_ws(socket, s))
 }