fix(build): clippy 1.93.0 compliance

clippy 1.93.0 added/tightened several lints that broke `cargo clippy -D warnings`
(the release gate). All behavior-preserving:

- unnecessary_map_or: `signer_parent.map_or(false, |r| …)` → `is_some_and`
  (relicario-server/src/main.rs).
- needless_question_mark: drop redundant `Ok(… ?)` wrappers around
  `serde_json::from_str(…).context(…)` in org_session.rs load_meta/load_members/
  load_collections.
- print_literal: inline the trailing "FLAG" header literal in `org audit`.
- items_after_test_module: move `configure_git_signing` above the
  `seed_helper_tests` module in device.rs so the test module is last.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Pe8qw5KePDqAEBsAxnVQuJ

crates/relicario-cli/src/commands/org.rs

@@ -732,7 +732,7 @@ pub fn run_audit(
     if json {
         println!("{}", serde_json::to_string_pretty(&events)?);
     } else {
-        println!("{:<44} {:<26} {:<20} {:<18} {}", "COMMIT", "TIMESTAMP", "ACTION", "ACTOR", "FLAG");
+        println!("{:<44} {:<26} {:<20} {:<18} FLAG", "COMMIT", "TIMESTAMP", "ACTION", "ACTOR");
         for ev in &events {
             println!("{:<44} {:<26} {:<20} {:<18} {}",
                 ev.commit,

crates/relicario-cli/src/device.rs

@@ -169,6 +169,47 @@ pub fn delete_device_keys(name: &str) -> Result<()> {
     Ok(())
 }
 
+/// Configure git in `vault_root` to:
+///  - sign commits with the device's signing key (SSH format)
+///  - push via SSH using the device's deploy key
+pub fn configure_git_signing(vault_root: &std::path::Path, name: &str) -> Result<()> {
+    let dir = device_dir(name)?;
+    let signing_key = dir.join("signing.key");
+    let deploy_key = dir.join("deploy.key");
+
+    // gpg.format = ssh so git uses SSH-format signing
+    crate::helpers::git_command(vault_root, &["config", "gpg.format", "ssh"])
+        .status()
+        .context("git config gpg.format")?;
+
+    // user.signingkey = path to the private key file
+    crate::helpers::git_command(
+        vault_root,
+        &["config", "user.signingkey", &signing_key.to_string_lossy()],
+    )
+    .status()
+    .context("git config user.signingkey")?;
+
+    // commit.gpgsign = true
+    crate::helpers::git_command(vault_root, &["config", "commit.gpgsign", "true"])
+        .status()
+        .context("git config commit.gpgsign")?;
+
+    // core.sshCommand — use only the deploy key for push
+    let ssh_cmd = format!(
+        "ssh -i {} -o IdentitiesOnly=yes",
+        deploy_key.display()
+    );
+    crate::helpers::git_command(
+        vault_root,
+        &["config", "core.sshCommand", &ssh_cmd],
+    )
+    .status()
+    .context("git config core.sshCommand")?;
+
+    Ok(())
+}
+
 #[cfg(test)]
 mod seed_helper_tests {
     use super::*;
@@ -215,44 +256,3 @@ mod seed_helper_tests {
         }
     }
 }
-
-/// Configure git in `vault_root` to:
-///  - sign commits with the device's signing key (SSH format)
-///  - push via SSH using the device's deploy key
-pub fn configure_git_signing(vault_root: &std::path::Path, name: &str) -> Result<()> {
-    let dir = device_dir(name)?;
-    let signing_key = dir.join("signing.key");
-    let deploy_key = dir.join("deploy.key");
-
-    // gpg.format = ssh so git uses SSH-format signing
-    crate::helpers::git_command(vault_root, &["config", "gpg.format", "ssh"])
-        .status()
-        .context("git config gpg.format")?;
-
-    // user.signingkey = path to the private key file
-    crate::helpers::git_command(
-        vault_root,
-        &["config", "user.signingkey", &signing_key.to_string_lossy()],
-    )
-    .status()
-    .context("git config user.signingkey")?;
-
-    // commit.gpgsign = true
-    crate::helpers::git_command(vault_root, &["config", "commit.gpgsign", "true"])
-        .status()
-        .context("git config commit.gpgsign")?;
-
-    // core.sshCommand — use only the deploy key for push
-    let ssh_cmd = format!(
-        "ssh -i {} -o IdentitiesOnly=yes",
-        deploy_key.display()
-    );
-    crate::helpers::git_command(
-        vault_root,
-        &["config", "core.sshCommand", &ssh_cmd],
-    )
-    .status()
-    .context("git config core.sshCommand")?;
-
-    Ok(())
-}

crates/relicario-cli/src/org_session.rs

@@ -56,12 +56,12 @@ impl UnlockedOrgVault {
     #[allow(dead_code)]
     pub fn load_meta(&self) -> Result<OrgMeta> {
         let s = fs::read_to_string(self.org_meta_path()).context("read org.json")?;
-        Ok(serde_json::from_str(&s).context("parse org.json")?)
+        serde_json::from_str(&s).context("parse org.json")
     }
 
     pub fn load_members(&self) -> Result<OrgMembers> {
         let s = fs::read_to_string(self.members_path()).context("read members.json")?;
-        Ok(serde_json::from_str(&s).context("parse members.json")?)
+        serde_json::from_str(&s).context("parse members.json")
     }
 
     pub fn save_members(&self, members: &OrgMembers) -> Result<()> {
@@ -71,7 +71,7 @@ impl UnlockedOrgVault {
 
     pub fn load_collections(&self) -> Result<OrgCollections> {
         let s = fs::read_to_string(self.collections_path()).context("read collections.json")?;
-        Ok(serde_json::from_str(&s).context("parse collections.json")?)
+        serde_json::from_str(&s).context("parse collections.json")
     }
 
     pub fn save_collections(&self, collections: &OrgCollections) -> Result<()> {

crates/relicario-server/src/main.rs

@@ -468,7 +468,7 @@ fn enforce_owner_only_elevation(
     // The signer's authority = their PARENT role. A member absent from the parent
     // (brand new) has no prior authority and cannot mint owners/admins.
     let signer_parent = parent_role(signer.member_id.as_str());
-    let signer_may_manage_owners = signer_parent.map_or(false, |r| r.can_manage_owners());
+    let signer_may_manage_owners = signer_parent.is_some_and(|r| r.can_manage_owners());
 
     for m in &new_members.members {
         if !is_privileged(m.role) {