refactor(clippy): fix the never-loop error and clear all lint warnings

`cargo clippy --all-targets` was failing on a deny-by-default
`never_loop` in the analysis SSE handler (the `loop` always returned on
the first iteration — the stream `unfold` already re-enters per event),
plus ~28 warnings. All resolved with no behaviour change:

- admin/analysis SSE: drop the dead `loop` wrapper.
- app: match port literals directly instead of `if p == 80` guards.
- repo/user: separate doc list from the following paragraphs.
- repo/upload_history: `sort_by_key(Reverse(..))` over `sort_by`.
- crawler/nav test: construct the error directly (no `unwrap_err` on a
  literal `Err`).
- test helpers: build configs via struct-update syntax instead of
  `Default::default()` + field reassignment; add a type alias for a
  complex audit-row tuple.
- plus the mechanical `deref`/etc. fixes from `cargo clippy --fix`.

Note: not running `cargo fmt` — the backend uses a consistent
hand-formatted style that differs from rustfmt-default across ~110
files, so a blanket reformat would be pure churn.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/src/settings.rs

@@ -567,11 +567,13 @@ mod tests {
 
     #[test]
     fn crawler_round_trips_through_dto() {
-        let mut base = CrawlerConfig::default();
-        base.start_url = Some("https://example.com/".to_string());
-        base.tz = Tz::Europe__Berlin;
-        base.chapter_workers = 3;
-        base.cookie_domain = Some("example.com".to_string());
+        let base = CrawlerConfig {
+            start_url: Some("https://example.com/".to_string()),
+            tz: Tz::Europe__Berlin,
+            chapter_workers: 3,
+            cookie_domain: Some("example.com".to_string()),
+            ..Default::default()
+        };
         let dto = CrawlerSettings::from_config(&base);
         let back = dto.to_config(&base).expect("valid");
         assert_eq!(back.tz, Tz::Europe__Berlin);
@@ -597,10 +599,12 @@ mod tests {
 
     #[test]
     fn crawler_overlay_preserves_env_only_fields() {
-        let mut base = CrawlerConfig::default();
-        base.proxy = Some("socks5://127.0.0.1:9050".to_string());
-        base.tor_control_password = Some("secret".to_string());
-        base.phpsessid = Some("abc123".to_string());
+        let base = CrawlerConfig {
+            proxy: Some("socks5://127.0.0.1:9050".to_string()),
+            tor_control_password: Some("secret".to_string()),
+            phpsessid: Some("abc123".to_string()),
+            ..Default::default()
+        };
         // A DTO that knows nothing about the env-only fields.
         let dto = CrawlerSettings {
             rate_ms: 2000,
@@ -704,8 +708,10 @@ mod tests {
 
     #[test]
     fn analysis_captures_env_prompt_override() {
-        let mut base = AnalysisConfig::default();
-        base.system_prompt = "custom env prompt".to_string();
+        let base = AnalysisConfig {
+            system_prompt: "custom env prompt".to_string(),
+            ..Default::default()
+        };
         let dto = AnalysisSettings::from_config(&base);
         assert_eq!(dto.system_prompt.as_deref(), Some("custom env prompt"));
     }
@@ -729,8 +735,10 @@ mod tests {
 
     #[test]
     fn analysis_overlay_preserves_api_key() {
-        let mut base = AnalysisConfig::default();
-        base.api_key = Some("sk-secret".to_string());
+        let base = AnalysisConfig {
+            api_key: Some("sk-secret".to_string()),
+            ..Default::default()
+        };
         let dto = AnalysisSettings::from_config(&base);
         assert_eq!(dto.to_config(&base).unwrap().api_key.as_deref(), Some("sk-secret"));
     }
@@ -872,8 +880,10 @@ mod tests {
         // a hostile/CSRF-able admin must NOT be able to point endpoint at
         // cloud metadata, loopback services, or RFC1918 hosts — when the
         // worker is enabled (toggling enabled=true later re-runs this gate).
-        let mut base = AnalysisConfig::default();
-        base.backend = AnalysisBackend::Vision;
+        let base = AnalysisConfig {
+            backend: AnalysisBackend::Vision,
+            ..Default::default()
+        };
         for url in [
             "http://169.254.169.254/v1/chat/completions",
             "http://127.0.0.1:5432/",
@@ -897,8 +907,10 @@ mod tests {
         // The documented default — docker DNS name resolving to a private IP
         // at runtime — must still validate, because the bearer recipient
         // identity is the operator-chosen hostname, not the underlying IP.
-        let mut base = AnalysisConfig::default();
-        base.backend = AnalysisBackend::Vision;
+        let base = AnalysisConfig {
+            backend: AnalysisBackend::Vision,
+            ..Default::default()
+        };
         for url in [
             "http://mangalord-vision:8000/v1/chat/completions",
             "https://api.openai.com/v1/chat/completions",
@@ -931,8 +943,10 @@ mod tests {
     fn analysis_requires_model_only_when_enabled() {
         // Vision base: the model id is required only when the vision worker
         // is actually live (see the OCR carve-out below).
-        let mut base = AnalysisConfig::default();
-        base.backend = AnalysisBackend::Vision;
+        let base = AnalysisConfig {
+            backend: AnalysisBackend::Vision,
+            ..Default::default()
+        };
         let disabled = AnalysisSettings {
             enabled: false,
             model: "".to_string(),