Require CDN_BASE_URL everywhere so no cover URL can expire
Exorcise sweep: strip AI tells from server copy, comments, and docs
server: adopt lint block, fix clippy, fmt
Format the tree with rustfmt and add the lint + supply-chain gates