style(backend): rustfmt the whole tree; gate cargo fmt --check in CI

The backend had never been run through rustfmt. Doing it in one mechanical pass (134 files)
so no future functional diff is buried under formatting churn, then gating `cargo fmt
--check` in checks.yml so it stays clean.

Formatting only — no logic, SQL, or behaviour changed. Verified after the reformat:
cargo test 56 passed, clippy --all-targets -D warnings clean, cargo fmt --check clean.

This is the deferred cleanup noted when CI's Format step was first left out.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/tests/upload_concurrency.rs

@@ -17,12 +17,7 @@ use uuid::Uuid;
 
 /// SRC: `handlers/upload.rs:313-322` — the guarded quota increment, verbatim.
 /// Returns `rows_affected()`; the handler aborts the whole upload tx when this is 0.
-async fn quota_inc(
-    exec: impl sqlx::PgExecutor<'_>,
-    user_id: Uuid,
-    size: i64,
-    limit: i64,
-) -> u64 {
+async fn quota_inc(exec: impl sqlx::PgExecutor<'_>, user_id: Uuid, size: i64, limit: i64) -> u64 {
     sqlx::query(
         "UPDATE \"user\" SET total_upload_bytes = total_upload_bytes + $2
          WHERE id = $1 AND total_upload_bytes + $2 <= $3",
@@ -69,7 +64,11 @@ async fn quota_two_attempts_from_one_stale_snapshot_cannot_both_commit(pool: PgP
     // Each upload, judged against that snapshot alone, fits: 0 + 60 <= 100. Twice.
     assert!(snapshot + SIZE <= LIMIT);
 
-    assert_eq!(quota_inc(&pool, user_id, SIZE, LIMIT).await, 1, "the first upload commits");
+    assert_eq!(
+        quota_inc(&pool, user_id, SIZE, LIMIT).await,
+        1,
+        "the first upload commits"
+    );
     assert_eq!(
         quota_inc(&pool, user_id, SIZE, LIMIT).await,
         0,
@@ -77,7 +76,11 @@ async fn quota_two_attempts_from_one_stale_snapshot_cannot_both_commit(pool: PgP
          (60 + 60 = 120 > 100). rows_affected() == 0 is what makes the handler abort."
     );
 
-    assert_eq!(total_bytes(&pool, user_id).await, SIZE, "never 120 — the quota held");
+    assert_eq!(
+        total_bytes(&pool, user_id).await,
+        SIZE,
+        "never 120 — the quota held"
+    );
 }
 
 /// The same, but genuinely CONCURRENT: two transactions that both read `total = 0`, then both try to
@@ -126,9 +129,17 @@ async fn quota_guard_is_atomic_under_concurrent_transactions(pool: PgPool) {
 
     // And an upload that legitimately fits in what's left still succeeds — the guard rejects
     // overruns, not everything.
-    assert_eq!(quota_inc(&pool, user_id, 40, LIMIT).await, 1, "0 + 60 + 40 == 100, exactly at the limit");
+    assert_eq!(
+        quota_inc(&pool, user_id, 40, LIMIT).await,
+        1,
+        "0 + 60 + 40 == 100, exactly at the limit"
+    );
     assert_eq!(total_bytes(&pool, user_id).await, LIMIT);
-    assert_eq!(quota_inc(&pool, user_id, 1, LIMIT).await, 0, "and one byte more is refused");
+    assert_eq!(
+        quota_inc(&pool, user_id, 1, LIMIT).await,
+        0,
+        "and one byte more is refused"
+    );
 }
 
 // ─────────────────────────────────────────────────────────────────────────────
@@ -140,11 +151,13 @@ async fn lock_and_read_event(
     tx: &mut sqlx::PgConnection,
     event_id: Uuid,
 ) -> (Option<DateTime<Utc>>, Option<DateTime<Utc>>) {
-    sqlx::query_as("SELECT uploads_locked_at, export_released_at FROM event WHERE id = $1 FOR SHARE")
-        .bind(event_id)
-        .fetch_one(tx)
-        .await
-        .expect("FOR SHARE re-check")
+    sqlx::query_as(
+        "SELECT uploads_locked_at, export_released_at FROM event WHERE id = $1 FOR SHARE",
+    )
+    .bind(event_id)
+    .fetch_one(tx)
+    .await
+    .expect("FOR SHARE re-check")
 }
 
 /// THE GUARD AGAINST SILENT, PERMANENT PHOTO LOSS.
@@ -167,7 +180,10 @@ async fn for_share_upload_lock_serializes_against_release(pool: PgPool) {
     // ── The guest's upload transaction takes the share lock. ──
     let mut upload_tx = pool.begin().await.unwrap();
     let (locked, released) = lock_and_read_event(&mut upload_tx, event_id).await;
-    assert!(locked.is_none() && released.is_none(), "uploads are open, so we proceed to commit");
+    assert!(
+        locked.is_none() && released.is_none(),
+        "uploads are open, so we proceed to commit"
+    );
 
     // ── Concurrently, the host hits "Galerie freigeben". ──
     let release_done = Arc::new(AtomicBool::new(false));
@@ -230,7 +246,11 @@ async fn for_share_upload_lock_serializes_against_release(pool: PgPool) {
     .fetch_all(&pool)
     .await
     .unwrap();
-    assert_eq!(snapshot, vec![upload_id], "the released keepsake CONTAINS the in-flight photo");
+    assert_eq!(
+        snapshot,
+        vec![upload_id],
+        "the released keepsake CONTAINS the in-flight photo"
+    );
 }
 
 /// The other side of the same lock: once the release has COMMITTED, the next upload's `FOR SHARE`
@@ -255,14 +275,23 @@ async fn upload_after_release_commits_sees_the_lock_and_is_rejected(pool: PgPool
     // After it, the identical re-check sees the release and the handler bails out.
     let mut tx = pool.begin().await.unwrap();
     let (locked, released) = lock_and_read_event(&mut tx, event_id).await;
-    assert!(released.is_some(), "the FOR SHARE re-read MUST observe the committed release");
-    assert!(locked.is_some(), "release locks uploads in the same statement (release ⇒ lock)");
+    assert!(
+        released.is_some(),
+        "the FOR SHARE re-read MUST observe the committed release"
+    );
+    assert!(
+        locked.is_some(),
+        "release locks uploads in the same statement (release ⇒ lock)"
+    );
     tx.rollback().await.unwrap();
 
     // And a reopen makes it uploadable again — the rejection was reversible, not terminal.
     assert_eq!(open_event(&pool, "wedding").await, 1);
     let mut tx = pool.begin().await.unwrap();
     let (locked, released) = lock_and_read_event(&mut tx, event_id).await;
-    assert!(locked.is_none() && released.is_none(), "the guest can resume their upload");
+    assert!(
+        locked.is_none() && released.is_none(),
+        "the guest can resume their upload"
+    );
     tx.rollback().await.unwrap();
 }