ci: add GitHub Actions workflows with semantic-release auto-versioning

chore: fix all 702 clippy warnings across codebase
- auto-fix 475 via cargo clippy --fix
- fix remaining 227 manually: uninlined_format_args, redundant_closure, match_same_arms,
  underscore_binding, format_push_string, items_after_statements, needless_pass_by_value,
  clone_on_copy, case_sensitive_extension, single_match/let-else, write_with_newline,
  and other clippy lints

src/service/oauth/manager.rs

@@ -72,13 +72,13 @@ impl OAuthManager {
             .post(&self.config.token_url)
             .form(&params)
             .send()
-            .map_err(|e| format!("token request failed: {}", e))?;
+            .map_err(|e| format!("token request failed: {e}"))?;
 
         let status = resp.status();
-        let body: serde_json::Value = resp.json().map_err(|e| format!("parse failed: {}", e))?;
+        let body: serde_json::Value = resp.json().map_err(|e| format!("parse failed: {e}"))?;
 
         if !status.is_success() {
-            return Err(format!("token endpoint returned {}: {}", status, body));
+            return Err(format!("token endpoint returned {status}: {body}"));
         }
 
         let access_token = body["access_token"].as_str().ok_or("missing access_token")?.to_string();
@@ -87,7 +87,7 @@ impl OAuthManager {
 
         self.token = Some(OAuthToken {
             access_token,
-            refresh_token: body["refresh_token"].as_str().map(|s| s.to_string()),
+            refresh_token: body["refresh_token"].as_str().map(std::string::ToString::to_string),
             expires_at: now + expires_in,
             token_type: body["token_type"].as_str().unwrap_or("Bearer").to_string(),
         });
@@ -98,7 +98,7 @@ impl OAuthManager {
     /// Build the provider's authorization URL with PKCE and state params attached.
     ///
     /// Why: refuses to build a URL if `auth_url` is missing or invalid. Previously
-    /// this silently fell back to https://example.com, which produced a valid-looking
+    /// this silently fell back to <https://example.com>, which produced a valid-looking
     /// auth URL pointing at the wrong server and leaked client credentials in
     /// query params. Returning an empty string signals failure to callers, who
     /// can prompt the user to fix the OAuth config instead of starting a flow