Follow the Rust style guide's smaller rules (#353)

Measured against /src/styleguide/rustguide.md:
- Each use statement imports from one module, and free functions are
  called through theirs (db::step, db::now, jsonwebtoken::decode,
  crate::feed::redact, unix::signal) rather than imported bare.
- unsafe_code is forbidden workspace-wide. The one unsafe was a test's
  set_var, which is unsound while other tests' threads read the
  environment; the test now reads PATH, which every run has.
- Locks say why they may panic: expect("a panic elsewhere poisoned this
  lock") in place of 25 unwraps, and unique_slug's endless search says
  it cannot end.
- No combinator chains in for headers: each is a named variable first.
- #[must_use] on the 27 functions clippy's must_use_candidate names.
- A literal bool passed where its meaning is not plain gets its name
  (/* keep_open */ true, /* piece */ false, ...).

No behaviour changes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

crates/directory/src/lib.rs

@@ -180,14 +180,14 @@ impl Directory {
     /// Takes the tokens of a config file read again, and drops the snapshots of any that went.
     pub async fn set_tokens(&self, tokens: Vec<Token>) -> anyhow::Result<u64> {
         let names: Vec<String> = tokens.iter().map(|t| t.name.clone()).collect();
-        *self.tokens.write().unwrap() = tokens;
+        *self.tokens.write().expect("a panic elsewhere poisoned this lock") = tokens;
         self.store.keep_instances(&names).await
     }
 
     fn caller(&self, presented: &str) -> Option<Me> {
         let h = config::hash(presented);
         // Every token compared, whether or not one matched, so timing says nothing either way.
-        self.tokens.read().unwrap().iter().fold(None, |found, t| {
+        self.tokens.read().expect("a panic elsewhere poisoned this lock").iter().fold(None, |found, t| {
             if config::same_secret(&t.sha256, &h) { Some(Me { name: t.name.clone(), access: t.access }) } else { found }
         })
     }