style: fmt + clippy cleanup after Phase B

cargo fmt regroups, plus three Phase-B clippy fixes:
- F-P-004: #[allow(clippy::type_complexity)] on the invoke_ast_cache Mutex.
- F-P-008: hoist `futures::stream::{self, TryStreamExt}` to the top-of-
  file imports to satisfy clippy::items_after_statements.
- F-P-005: rename `_legacy_offset` to `legacy_offset` + #[allow(dead_code)]
  to satisfy clippy's "field is pub but `_`-prefixed" check.

No behavior change.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

crates/manager-core/src/users_service.rs

@@ -610,9 +610,10 @@ impl UsersService for UsersServiceImpl {
             None => (TIMING_FLAT_DUMMY_HASH.to_string(), None, None),
         };
         // F-P-002: Argon2id verify off the async worker.
-        let password_ok = tokio::task::spawn_blocking(move || verify_password(&hash, &password_owned))
-            .await
-            .map_err(|e| UsersError::Backend(format!("verify spawn_blocking join: {e}")))?;
+        let password_ok =
+            tokio::task::spawn_blocking(move || verify_password(&hash, &password_owned))
+                .await
+                .map_err(|e| UsersError::Backend(format!("verify spawn_blocking join: {e}")))?;
         let (Some(user_id), Some(app_id)) = (user_id, app_id) else {
             return Ok(None);
         };