style: fmt + clippy cleanup after Phase C

cargo fmt regroups; three clippy fixes:
- F-S-006: hoist MAX_API_KEY_CANDIDATES to module scope to satisfy
  clippy::items_after_statements.
- F-S-009: use map_or instead of map().unwrap_or() per
  clippy::map_unwrap_or.
- F-P-012: replace `|c| c.encode()` closure with the method itself
  per clippy::redundant_closure_for_method_calls.

No behavior change.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

crates/manager-core/src/auth_middleware.rs

@@ -53,6 +53,11 @@ pub struct PrincipalCache {
 /// adjacent requests on a hot key.
 const PRINCIPAL_CACHE_TTL: Duration = Duration::from_secs(60);
 
+/// F-S-006: maximum candidate API keys we'll Argon2-verify per
+/// request. Hoisted to module scope so clippy::items_after_statements
+/// is happy.
+const MAX_API_KEY_CANDIDATES: usize = 16;
+
 impl PrincipalCache {
     #[must_use]
     pub fn new() -> Self {
@@ -277,7 +282,6 @@ async fn verify_api_key(state: &AuthState, rest: &str) -> Result<Option<Principa
     // many keys against one indexed prefix could amplify each public
     // bearer-tagged request into M×Argon2 verifies. Cap at MAX and
     // log the truncation so operators can spot it.
-    const MAX_API_KEY_CANDIDATES: usize = 16;
     if candidates.len() > MAX_API_KEY_CANDIDATES {
         tracing::warn!(
             prefix,