style: fmt + clippy cleanup after Phase C

cargo fmt regroups; three clippy fixes:
- F-S-006: hoist MAX_API_KEY_CANDIDATES to module scope to satisfy
  clippy::items_after_statements.
- F-S-009: use map_or instead of map().unwrap_or() per
  clippy::map_unwrap_or.
- F-P-012: replace `|c| c.encode()` closure with the method itself
  per clippy::redundant_closure_for_method_calls.

No behavior change.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

crates/shared/src/crypto.rs

@@ -207,7 +207,7 @@ impl MasterKey {
         let dev_ack = std::env::var("PICLOUD_DEV_INSECURE_KEY")
             .map(|v| v == "i-understand-this-is-insecure")
             .unwrap_or(false);
-        if dev_mode && secret.as_deref().map(str::trim).unwrap_or("").is_empty() && !dev_ack {
+        if dev_mode && secret.as_deref().map_or("", str::trim).is_empty() && !dev_ack {
             return Err(MasterKeyError::DevModeUnacknowledged);
         }
         Self::resolve(secret.as_deref(), dev_mode)