-
Drop openssl from the server: webauthn-rs 0.6, and an explicit rustls provider
-
server: adopt lint block, fix clippy, fmt
-
Format the tree with rustfmt and add the lint + supply-chain gates
-
Decompose AppState Phase 2: migrate remaining api top-level + exports
-
Harden the OTA path and stop orphaning S3 on failed cleanup enqueue (ultra-fuzz Run 12 Storage)
-
Run CPU-bound Argon2 off the async runtime (ultra-fuzz Run 10 C1)