feat: Sprint 1 — production hardening, TLS lifecycle, CI coverage, lint cleanup

- Fix 3 client panics: replace .unwrap()/.expect() with proper error
  handling in rpc.rs (AUTH_CONTEXT lock), repl.rs (pending_member),
  and retry.rs (last_err)
- Add --danger-accept-invalid-certs flag with InsecureServerCertVerifier
  for development TLS bypass, plus mdBook TLS documentation
- Add CI coverage job (cargo-tarpaulin) and Docker build validation
  to GitHub Actions workflow, plus README CI badge
- Add [workspace.lints] config, fix 46 clippy warnings across 8 crates,
  zero warnings on all buildable crates
- Update Dockerfile for all 11 workspace members

crates/quicproquo-client/src/client/commands.rs

@@ -27,8 +27,8 @@ pub fn cmd_whoami(state_path: &Path, password: Option<&str>) -> anyhow::Result<(
     let pk_bytes = identity.public_key_bytes();
     let fingerprint = sha256(&pk_bytes);
 
-    println!("identity_key : {}", hex::encode(&pk_bytes));
-    println!("fingerprint  : {}", hex::encode(&fingerprint));
+    println!("identity_key : {}", hex::encode(pk_bytes));
+    println!("fingerprint  : {}", hex::encode(fingerprint));
     println!(
         "hybrid_key   : {}",
         if state.hybrid_key.is_some() {
@@ -203,6 +203,7 @@ pub async fn cmd_register_user(
 }
 
 /// Log in via the OPAQUE protocol and receive a session token.
+#[allow(clippy::too_many_arguments)]
 pub async fn cmd_login(
     server: &str,
     ca_cert: &Path,
@@ -522,7 +523,7 @@ async fn do_upload_keypackage(
 
     anyhow::ensure!(server_fp == fingerprint, "fingerprint mismatch");
 
-    if let Some(ref hkp) = hybrid_kp {
+    if let Some(hkp) = &hybrid_kp {
         upload_hybrid_key(
             &node_client,
             &member.identity().public_key_bytes(),
@@ -914,6 +915,7 @@ pub async fn cmd_join(
 }
 
 /// Send an application message via DS (single recipient or broadcast to all other members).
+#[allow(clippy::too_many_arguments)]
 pub async fn cmd_send(
     state_path: &Path,
     server: &str,
@@ -1115,8 +1117,8 @@ pub fn whoami_json(state_path: &Path, password: Option<&str>) -> anyhow::Result<
     let fingerprint = sha256(&pk_bytes);
     Ok(format!(
         r#"{{"identity_key":"{}", "fingerprint":"{}", "hybrid_key":{}, "group":{}}}"#,
-        hex::encode(&pk_bytes),
-        hex::encode(&fingerprint),
+        hex::encode(pk_bytes),
+        hex::encode(fingerprint),
         state.hybrid_key.is_some(),
         state.group.is_some(),
     ))