chore(v1.1.8): clippy --all-targets clean (F2)

Sweep the v1.1.8-introduced clippy warnings under
--workspace --all-targets --all-features -- -D warnings:

  * 12x map_unwrap_or in executor-core/sdk/users.rs — rewrite as
    map_or; mostly the Option<X> -> Dynamic conversion shape.
  * Doc-list-without-indentation in
    app_user_password_reset_repo.rs's module docstring — rewrap
    so a continuation line doesn't start with `+ `.
  * usize-as-i64 cast in app_user_repo.rs list — use
    i64::try_from(...).unwrap_or(i64::MAX) for the cursor cap.
  * 2x map_unwrap_or in users_service.rs env helpers — map_or.
  * single-pattern match in users_service.rs login — let-else
    rewrite so the dummy-Argon2 side-effect stays in the
    diverging branch (no semantic change).

Also updated the 10 executor-core integration-test bins
(sdk_email, sdk_kv, sdk_docs, sdk_files, sdk_pubsub,
sdk_secrets, sdk_http, sdk_subscriber_token,
module_redaction_logging, modules) to pass the new
NoopUsersService positional arg into Services::new().

NOTE — the brief specifies running this attestation under `cargo
clean` first. I skipped the clean step because an earlier
`cargo test --workspace` froze this host (the user explicitly
asked me to keep subsequent builds lighter). The incremental
cache was hot for every workspace crate when clippy ran; test
binaries appeared in the Checking output as expected. Flagged in
HANDBACK §6 F2 + §7.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

crates/manager-core/src/users_service.rs

@@ -109,16 +109,14 @@ fn env_duration_hours(var: &str, default: Duration) -> Duration {
     std::env::var(var)
         .ok()
         .and_then(|s| s.parse::<u64>().ok())
-        .map(|h| Duration::from_secs(h * 3600))
-        .unwrap_or(default)
+        .map_or(default, |h| Duration::from_secs(h * 3600))
 }
 
 fn env_duration_days(var: &str, default: Duration) -> Duration {
     std::env::var(var)
         .ok()
         .and_then(|s| s.parse::<u64>().ok())
-        .map(|d| Duration::from_secs(d * 24 * 3600))
-        .unwrap_or(default)
+        .map_or(default, |d| Duration::from_secs(d * 24 * 3600))
 }
 
 /// Postgres-backed `UsersService`.
@@ -485,14 +483,11 @@ impl UsersService for UsersServiceImpl {
             .await?;
         // Both branches normalize the email so an attacker can't probe
         // existence via "" / "x" / very-long-string differences.
-        let normalized = match validate_email(email) {
-            Ok(e) => e,
-            Err(_) => {
-                // Still run a dummy verify so the timing of an invalid
-                // email shape matches the timing of a legitimate miss.
-                let _ = verify_password(TIMING_FLAT_DUMMY_HASH, password);
-                return Ok(None);
-            }
+        let Ok(normalized) = validate_email(email) else {
+            // Still run a dummy verify so the timing of an invalid
+            // email shape matches the timing of a legitimate miss.
+            let _ = verify_password(TIMING_FLAT_DUMMY_HASH, password);
+            return Ok(None);
         };
         let creds = self
             .users