fix(build): clippy 1.93.0 compliance

clippy 1.93.0 added/tightened several lints that broke `cargo clippy -D warnings`
(the release gate). All behavior-preserving:

- unnecessary_map_or: `signer_parent.map_or(false, |r| …)` → `is_some_and`
  (relicario-server/src/main.rs).
- needless_question_mark: drop redundant `Ok(… ?)` wrappers around
  `serde_json::from_str(…).context(…)` in org_session.rs load_meta/load_members/
  load_collections.
- print_literal: inline the trailing "FLAG" header literal in `org audit`.
- items_after_test_module: move `configure_git_signing` above the
  `seed_helper_tests` module in device.rs so the test module is last.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Pe8qw5KePDqAEBsAxnVQuJ

crates/relicario-cli/src/device.rs

@@ -169,6 +169,47 @@ pub fn delete_device_keys(name: &str) -> Result<()> {
     Ok(())
 }
 
+/// Configure git in `vault_root` to:
+///  - sign commits with the device's signing key (SSH format)
+///  - push via SSH using the device's deploy key
+pub fn configure_git_signing(vault_root: &std::path::Path, name: &str) -> Result<()> {
+    let dir = device_dir(name)?;
+    let signing_key = dir.join("signing.key");
+    let deploy_key = dir.join("deploy.key");
+
+    // gpg.format = ssh so git uses SSH-format signing
+    crate::helpers::git_command(vault_root, &["config", "gpg.format", "ssh"])
+        .status()
+        .context("git config gpg.format")?;
+
+    // user.signingkey = path to the private key file
+    crate::helpers::git_command(
+        vault_root,
+        &["config", "user.signingkey", &signing_key.to_string_lossy()],
+    )
+    .status()
+    .context("git config user.signingkey")?;
+
+    // commit.gpgsign = true
+    crate::helpers::git_command(vault_root, &["config", "commit.gpgsign", "true"])
+        .status()
+        .context("git config commit.gpgsign")?;
+
+    // core.sshCommand — use only the deploy key for push
+    let ssh_cmd = format!(
+        "ssh -i {} -o IdentitiesOnly=yes",
+        deploy_key.display()
+    );
+    crate::helpers::git_command(
+        vault_root,
+        &["config", "core.sshCommand", &ssh_cmd],
+    )
+    .status()
+    .context("git config core.sshCommand")?;
+
+    Ok(())
+}
+
 #[cfg(test)]
 mod seed_helper_tests {
     use super::*;
@@ -215,44 +256,3 @@ mod seed_helper_tests {
         }
     }
 }
-
-/// Configure git in `vault_root` to:
-///  - sign commits with the device's signing key (SSH format)
-///  - push via SSH using the device's deploy key
-pub fn configure_git_signing(vault_root: &std::path::Path, name: &str) -> Result<()> {
-    let dir = device_dir(name)?;
-    let signing_key = dir.join("signing.key");
-    let deploy_key = dir.join("deploy.key");
-
-    // gpg.format = ssh so git uses SSH-format signing
-    crate::helpers::git_command(vault_root, &["config", "gpg.format", "ssh"])
-        .status()
-        .context("git config gpg.format")?;
-
-    // user.signingkey = path to the private key file
-    crate::helpers::git_command(
-        vault_root,
-        &["config", "user.signingkey", &signing_key.to_string_lossy()],
-    )
-    .status()
-    .context("git config user.signingkey")?;
-
-    // commit.gpgsign = true
-    crate::helpers::git_command(vault_root, &["config", "commit.gpgsign", "true"])
-        .status()
-        .context("git config commit.gpgsign")?;
-
-    // core.sshCommand — use only the deploy key for push
-    let ssh_cmd = format!(
-        "ssh -i {} -o IdentitiesOnly=yes",
-        deploy_key.display()
-    );
-    crate::helpers::git_command(
-        vault_root,
-        &["config", "core.sshCommand", &ssh_cmd],
-    )
-    .status()
-    .context("git config core.sshCommand")?;
-
-    Ok(())
-}