server: adopt lint block, fix clippy, fmt
Format the tree with rustfmt and add the lint + supply-chain gates
server: fold in outstanding working-tree changes
server: replace global CSRF allowlist with per-route posture helpers