style: fmt + clippy cleanup after Phase C

cargo fmt regroups; three clippy fixes:
- F-S-006: hoist MAX_API_KEY_CANDIDATES to module scope to satisfy
  clippy::items_after_statements.
- F-S-009: use map_or instead of map().unwrap_or() per
  clippy::map_unwrap_or.
- F-P-012: replace `|c| c.encode()` closure with the method itself
  per clippy::redundant_closure_for_method_calls.

No behavior change.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

crates/picloud/src/lib.rs

@@ -362,8 +362,7 @@ pub async fn build_app(
     // Dispatcher — single tokio task that polls the outbox and routes
     // due rows to the executor. Shares the `ExecutionGate` with sync
     // HTTP per design notes §2 (one cap for everything).
-    let dispatcher_script_repo: Arc<dyn ScriptRepository> =
-        script_repo.clone();
+    let dispatcher_script_repo: Arc<dyn ScriptRepository> = script_repo.clone();
     let principals: Arc<dyn PrincipalResolver> =
         Arc::new(AdminPrincipalResolver::new(auth.users.clone()));
     // The InboxRegistry is constructed once and shared between the