agent: lumotia — pin rust toolchain + workspace clippy/fmt sweep

rust-toolchain.toml pins to stable 1.94.1 so contributors and CI runners
share the exact rustc / rustfmt / clippy versions. Without the pin, every
machine surfaces a different lint set depending on its local install — six
pre-existing lints showed up on 1.94.1 that 1.93-era HANDOVER reported clean.

Clippy fixes (all pre-existing, not introduced by feature work):

- crates/storage/src/database.rs: std::iter::repeat().take() -> repeat_n()
- crates/llm/src/lib.rs (docs): "+ frontends" was parsed as a markdown bullet
  continuation by rustdoc, breaking doc-lazy-continuation. Reworded to "and".
- crates/llm/src/lib.rs (loop): while-let-on-iterator -> for-loop.
- src-tauri/src/commands/security.rs: .iter().any(|a| *a == x) -> .contains(&x).
- src-tauri/src/lib.rs: io::Error::new(Other, e) -> io::Error::other(e).
- src-tauri/src/tauri_app_data_migration.rs: drop function-tail `return`s
  inside cfg blocks; each platform's block now ends with a tail expression.

cargo fmt sweep across the workspace. Mechanical layout-only changes;
no semantics affected.

Workspace gates after this commit:
- cargo fmt --check: clean
- cargo clippy --workspace --all-targets -- -D warnings: clean
- cargo test --workspace: 405/0 (will become 409/0 with Phase A.1+A.2)

crates/hotkey/tests/listener_lifecycle.rs

@@ -143,8 +143,7 @@ async fn reconfigure_does_not_leak_forwarder() {
     // (orphaned listener tasks still holding sender clones), the
     // forwarder would never see `None` from recv() and this timeout
     // would fire.
-    let join_result =
-        tokio::time::timeout(Duration::from_secs(5), forwarder_1).await;
+    let join_result = tokio::time::timeout(Duration::from_secs(5), forwarder_1).await;
     assert!(
         join_result.is_ok(),
         "old forwarder did not join after listener.stop() — Race-2 regressed: \
@@ -176,8 +175,7 @@ async fn reconfigure_does_not_leak_forwarder() {
 
     // ---- Cleanup ----
     listener_2.stop().await;
-    let cleanup_join =
-        tokio::time::timeout(Duration::from_secs(5), forwarder_2).await;
+    let cleanup_join = tokio::time::timeout(Duration::from_secs(5), forwarder_2).await;
     assert!(
         cleanup_join.is_ok(),
         "second forwarder also failed to drain after stop()"
@@ -189,5 +187,8 @@ async fn reconfigure_does_not_leak_forwarder() {
     // count. The counters exist so the test compiles as a real
     // forwarder pattern matching what commands::hotkey does in
     // production.
-    let _ = (received_first.load(Ordering::SeqCst), received_second.load(Ordering::SeqCst));
+    let _ = (
+        received_first.load(Ordering::SeqCst),
+        received_second.load(Ordering::SeqCst),
+    );
 }