style: fmt + clippy cleanup after Phase B

cargo fmt regroups, plus three Phase-B clippy fixes:
- F-P-004: #[allow(clippy::type_complexity)] on the invoke_ast_cache Mutex.
- F-P-008: hoist `futures::stream::{self, TryStreamExt}` to the top-of-
  file imports to satisfy clippy::items_after_statements.
- F-P-005: rename `_legacy_offset` to `legacy_offset` + #[allow(dead_code)]
  to satisfy clippy's "field is pub but `_`-prefixed" check.

No behavior change.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

crates/manager-core/src/auth_api.rs

@@ -97,15 +97,14 @@ async fn login(State(state): State<AuthState>, Json(input): Json<LoginRequest>)
 
     // F-P-002: Argon2id verify off the async worker.
     let password = input.password.clone();
-    let password_ok = match tokio::task::spawn_blocking(move || verify_password(&stored_hash, &password))
-        .await
-    {
-        Ok(b) => b,
-        Err(err) => {
-            tracing::error!(?err, "verify_password spawn_blocking join failed");
-            return internal_error();
-        }
-    };
+    let password_ok =
+        match tokio::task::spawn_blocking(move || verify_password(&stored_hash, &password)).await {
+            Ok(b) => b,
+            Err(err) => {
+                tracing::error!(?err, "verify_password spawn_blocking join failed");
+                return internal_error();
+            }
+        };
     if !password_ok || user_id.is_none() || !is_active {
         return invalid_credentials();
     }