style: fmt + clippy cleanup after Phase B

cargo fmt regroups, plus three Phase-B clippy fixes:
- F-P-004: #[allow(clippy::type_complexity)] on the invoke_ast_cache Mutex.
- F-P-008: hoist `futures::stream::{self, TryStreamExt}` to the top-of-
  file imports to satisfy clippy::items_after_statements.
- F-P-005: rename `_legacy_offset` to `legacy_offset` + #[allow(dead_code)]
  to satisfy clippy's "field is pub but `_`-prefixed" check.

No behavior change.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

crates/executor-core/src/engine.rs

@@ -58,6 +58,7 @@ pub struct Engine {
     /// callee on every invoke. Independent of the orchestrator-core
     /// `LocalExecutorClient` AST cache — that one caches HTTP-path
     /// dispatch; this one caches function-call dispatch.
+    #[allow(clippy::type_complexity)]
     invoke_ast_cache: Mutex<HashMap<ScriptId, (DateTime<Utc>, Arc<AST>)>>,
 }
 

crates/manager-core/src/api.rs

@@ -381,8 +381,10 @@ pub struct LogsQuery {
     /// silently ignored to keep older dashboards from 400'ing.
     #[serde(default)]
     pub cursor: Option<String>,
+    /// Legacy field — accepted and ignored so older dashboards don't 400.
     #[serde(default, rename = "offset")]
-    pub _legacy_offset: Option<i64>,
+    #[allow(dead_code)]
+    pub legacy_offset: Option<i64>,
 }
 
 const fn default_limit() -> i64 {

crates/manager-core/src/auth_api.rs

@@ -97,15 +97,14 @@ async fn login(State(state): State<AuthState>, Json(input): Json<LoginRequest>)
 
     // F-P-002: Argon2id verify off the async worker.
     let password = input.password.clone();
-    let password_ok = match tokio::task::spawn_blocking(move || verify_password(&stored_hash, &password))
-        .await
-    {
-        Ok(b) => b,
-        Err(err) => {
-            tracing::error!(?err, "verify_password spawn_blocking join failed");
-            return internal_error();
-        }
-    };
+    let password_ok =
+        match tokio::task::spawn_blocking(move || verify_password(&stored_hash, &password)).await {
+            Ok(b) => b,
+            Err(err) => {
+                tracing::error!(?err, "verify_password spawn_blocking join failed");
+                return internal_error();
+            }
+        };
     if !password_ok || user_id.is_none() || !is_active {
         return invalid_credentials();
     }

crates/manager-core/src/trigger_repo.rs

@@ -5,6 +5,7 @@
 
 use async_trait::async_trait;
 use chrono::{DateTime, Utc};
+use futures::stream::{self, TryStreamExt};
 use picloud_shared::{
     AdminUserId, AppId, DocsEventOp, FilesEventOp, KvEventOp, ScriptId, TriggerId,
 };
@@ -984,7 +985,6 @@ impl TriggerRepo for PostgresTriggerRepo {
         // sum(per-row-latency). Still N+1 queries against the details
         // tables — collapsing to a single per-kind LEFT JOIN is a
         // larger SQL refactor tracked as v1.2.
-        use futures::stream::{self, TryStreamExt};
         let pool = self.pool.clone();
         let out = stream::iter(parents.into_iter().map(Ok))
             .map_ok(|p| {

crates/manager-core/src/users_service.rs

@@ -610,9 +610,10 @@ impl UsersService for UsersServiceImpl {
             None => (TIMING_FLAT_DUMMY_HASH.to_string(), None, None),
         };
         // F-P-002: Argon2id verify off the async worker.
-        let password_ok = tokio::task::spawn_blocking(move || verify_password(&hash, &password_owned))
-            .await
-            .map_err(|e| UsersError::Backend(format!("verify spawn_blocking join: {e}")))?;
+        let password_ok =
+            tokio::task::spawn_blocking(move || verify_password(&hash, &password_owned))
+                .await
+                .map_err(|e| UsersError::Backend(format!("verify spawn_blocking join: {e}")))?;
         let (Some(user_id), Some(app_id)) = (user_id, app_id) else {
             return Ok(None);
         };