feat: Sprint 1 — production hardening, TLS lifecycle, CI coverage, lint cleanup

- Fix 3 client panics: replace .unwrap()/.expect() with proper error
  handling in rpc.rs (AUTH_CONTEXT lock), repl.rs (pending_member),
  and retry.rs (last_err)
- Add --danger-accept-invalid-certs flag with InsecureServerCertVerifier
  for development TLS bypass, plus mdBook TLS documentation
- Add CI coverage job (cargo-tarpaulin) and Docker build validation
  to GitHub Actions workflow, plus README CI badge
- Add [workspace.lints] config, fix 46 clippy warnings across 8 crates,
  zero warnings on all buildable crates
- Update Dockerfile for all 11 workspace members

crates/quicproquo-client/src/client/rpc.rs

@@ -5,7 +5,7 @@ use std::sync::Arc;
 use anyhow::Context;
 use quinn::{ClientConfig, Endpoint};
 use quinn_proto::crypto::rustls::QuicClientConfig;
-use rustls::pki_types::CertificateDer;
+use rustls::pki_types::{CertificateDer, ServerName, UnixTime};
 use rustls::{ClientConfig as RustlsClientConfig, RootCertStore};
 use tokio_util::compat::{TokioAsyncReadCompatExt, TokioAsyncWriteCompatExt};
 use capnp_rpc::{rpc_twoparty_capnp::Side, twoparty, RpcSystem};
@@ -13,34 +13,101 @@ use capnp_rpc::{rpc_twoparty_capnp::Side, twoparty, RpcSystem};
 use quicproquo_core::HybridPublicKey;
 use quicproquo_proto::node_capnp::{auth, node_service};
 
-use crate::AUTH_CONTEXT;
+use crate::{AUTH_CONTEXT, INSECURE_SKIP_VERIFY};
 
 use super::retry::{anyhow_is_retriable, retry_async, DEFAULT_BASE_DELAY_MS, DEFAULT_MAX_RETRIES};
 
 /// Cap'n Proto traversal limit (words). 4 Mi words = 32 MiB; bounds DoS from deeply nested or large messages.
 const CAPNP_TRAVERSAL_LIMIT_WORDS: usize = 4 * 1024 * 1024;
 
+/// A [`rustls::client::danger::ServerCertVerifier`] that accepts any certificate.
+///
+/// **Development only.** Using this in production disables all TLS guarantees.
+#[derive(Debug)]
+struct InsecureServerCertVerifier;
+
+impl rustls::client::danger::ServerCertVerifier for InsecureServerCertVerifier {
+    fn verify_server_cert(
+        &self,
+        _end_entity: &CertificateDer<'_>,
+        _intermediates: &[CertificateDer<'_>],
+        _server_name: &ServerName<'_>,
+        _ocsp_response: &[u8],
+        _now: UnixTime,
+    ) -> Result<rustls::client::danger::ServerCertVerified, rustls::Error> {
+        Ok(rustls::client::danger::ServerCertVerified::assertion())
+    }
+
+    fn verify_tls12_signature(
+        &self,
+        _message: &[u8],
+        _cert: &CertificateDer<'_>,
+        _dss: &rustls::DigitallySignedStruct,
+    ) -> Result<rustls::client::danger::HandshakeSignatureValid, rustls::Error> {
+        Ok(rustls::client::danger::HandshakeSignatureValid::assertion())
+    }
+
+    fn verify_tls13_signature(
+        &self,
+        _message: &[u8],
+        _cert: &CertificateDer<'_>,
+        _dss: &rustls::DigitallySignedStruct,
+    ) -> Result<rustls::client::danger::HandshakeSignatureValid, rustls::Error> {
+        Ok(rustls::client::danger::HandshakeSignatureValid::assertion())
+    }
+
+    fn supported_verify_schemes(&self) -> Vec<rustls::SignatureScheme> {
+        rustls::crypto::ring::default_provider()
+            .signature_verification_algorithms
+            .supported_schemes()
+    }
+}
+
 /// Establish a QUIC/TLS connection and return a `NodeService` client.
 ///
 /// Must be called from within a `LocalSet` because capnp-rpc is `!Send`.
+///
+/// Reads [`INSECURE_SKIP_VERIFY`] to decide whether to bypass certificate
+/// verification (set once at startup via [`crate::set_insecure_skip_verify`]).
 pub async fn connect_node(
     server: &str,
     ca_cert: &Path,
     server_name: &str,
+) -> anyhow::Result<node_service::Client> {
+    let skip = INSECURE_SKIP_VERIFY.load(std::sync::atomic::Ordering::Relaxed);
+    connect_node_opt(server, ca_cert, server_name, skip).await
+}
+
+/// Like [`connect_node`] but with an explicit `insecure_skip_verify` toggle.
+///
+/// When `insecure_skip_verify` is `true`, certificate verification is disabled entirely.
+/// This is intended for development and testing only.
+pub async fn connect_node_opt(
+    server: &str,
+    ca_cert: &Path,
+    server_name: &str,
+    insecure_skip_verify: bool,
 ) -> anyhow::Result<node_service::Client> {
     let addr: SocketAddr = server
         .parse()
         .with_context(|| format!("server must be host:port, got {server}"))?;
 
-    let cert_bytes = std::fs::read(ca_cert).with_context(|| format!("read ca_cert {ca_cert:?}"))?;
-    let mut roots = RootCertStore::empty();
-    roots
-        .add(CertificateDer::from(cert_bytes))
-        .context("add root cert")?;
-
-    let mut tls = RustlsClientConfig::builder()
-        .with_root_certificates(roots)
-        .with_no_client_auth();
+    let mut tls = if insecure_skip_verify {
+        RustlsClientConfig::builder()
+            .dangerous()
+            .with_custom_certificate_verifier(Arc::new(InsecureServerCertVerifier))
+            .with_no_client_auth()
+    } else {
+        let cert_bytes =
+            std::fs::read(ca_cert).with_context(|| format!("read ca_cert {ca_cert:?}"))?;
+        let mut roots = RootCertStore::empty();
+        roots
+            .add(CertificateDer::from(cert_bytes))
+            .context("add root cert")?;
+        RustlsClientConfig::builder()
+            .with_root_certificates(roots)
+            .with_no_client_auth()
+    };
     tls.alpn_protocols = vec![b"capnp".to_vec()];
 
     let crypto = QuicClientConfig::try_from(tls)
@@ -76,7 +143,9 @@ pub async fn connect_node(
 }
 
 pub fn set_auth(auth: &mut auth::Builder<'_>) -> anyhow::Result<()> {
-    let guard = AUTH_CONTEXT.read().expect("AUTH_CONTEXT poisoned");
+    let guard = AUTH_CONTEXT
+        .read()
+        .map_err(|e| anyhow::anyhow!("AUTH_CONTEXT lock poisoned: {e}"))?;
     let ctx = guard.as_ref().ok_or_else(|| {
         anyhow::anyhow!(
             "init_auth must be called before RPCs (use a bearer or session token for authenticated commands)"
@@ -257,7 +326,6 @@ pub async fn fetch_wait(
         || {
             let client = client.clone();
             let recipient_key = recipient_key.clone();
-            let timeout_ms = timeout_ms;
             async move {
                 let mut req = client.fetch_wait_request();
                 {