chore(v1.1.8): cargo fmt --all (reviewer)

8 files needed re-wrapping after the F2 clippy-fix pass landed
un-fmt'd. Pure cosmetic — no behavioral change. Re-runs of
`cargo fmt --all -- --check` now exit clean.

Reviewer-supplied per REVIEW.md §7; folded onto the branch
to avoid a NEEDS-CHANGES round-trip on a purely mechanical fix.

crates/manager-core/src/app_secrets_repo.rs

@@ -121,7 +121,8 @@ impl AppSecretsRepo for PostgresAppSecretsRepo {
         .fetch_one(&self.pool)
         .await?;
         // A row exists by construction, so a key must decode.
-        self.decode(row.0, row.1)?.ok_or(AppSecretsRepoError::Crypto)
+        self.decode(row.0, row.1)?
+            .ok_or(AppSecretsRepoError::Crypto)
     }
 
     async fn signing_key(&self, app_id: AppId) -> Result<Option<Vec<u8>>, AppSecretsRepoError> {
@@ -167,8 +168,8 @@ mod tests {
         let secret = vec![3u8; 32];
         let enc = crypto::encrypt(&secret, key().as_bytes());
         let other = MasterKey::from_bytes([1u8; 32]);
-        let err = decode_signing_key(&other, Some(enc.ciphertext), Some(enc.nonce.to_vec()))
-            .unwrap_err();
+        let err =
+            decode_signing_key(&other, Some(enc.ciphertext), Some(enc.nonce.to_vec())).unwrap_err();
         assert!(matches!(err, AppSecretsRepoError::Crypto));
     }
 }