agent: lumotia — pin rust toolchain + workspace clippy/fmt sweep

rust-toolchain.toml pins to stable 1.94.1 so contributors and CI runners
share the exact rustc / rustfmt / clippy versions. Without the pin, every
machine surfaces a different lint set depending on its local install — six
pre-existing lints showed up on 1.94.1 that 1.93-era HANDOVER reported clean.

Clippy fixes (all pre-existing, not introduced by feature work):

- crates/storage/src/database.rs: std::iter::repeat().take() -> repeat_n()
- crates/llm/src/lib.rs (docs): "+ frontends" was parsed as a markdown bullet
  continuation by rustdoc, breaking doc-lazy-continuation. Reworded to "and".
- crates/llm/src/lib.rs (loop): while-let-on-iterator -> for-loop.
- src-tauri/src/commands/security.rs: .iter().any(|a| *a == x) -> .contains(&x).
- src-tauri/src/lib.rs: io::Error::new(Other, e) -> io::Error::other(e).
- src-tauri/src/tauri_app_data_migration.rs: drop function-tail `return`s
  inside cfg blocks; each platform's block now ends with a tail expression.

cargo fmt sweep across the workspace. Mechanical layout-only changes;
no semantics affected.

Workspace gates after this commit:
- cargo fmt --check: clean
- cargo clippy --workspace --all-targets -- -D warnings: clean
- cargo test --workspace: 405/0 (will become 409/0 with Phase A.1+A.2)

crates/llm/src/lib.rs

@@ -256,7 +256,7 @@ impl LlmEngine {
     }
 
     /// True iff a model load is currently in flight. Exposed for tests
-    /// + frontends that want to render a "loading…" state without
+    /// and frontends that want to render a "loading…" state without
     /// polling `is_loaded()` (which returns false during a swap).
     pub fn is_loading(&self) -> bool {
         self.loading.load(Ordering::Acquire)
@@ -630,7 +630,7 @@ fn extract_json_envelope(text: &str) -> Option<&str> {
     let mut in_string = false;
     let mut escaped = false;
 
-    while let Some((offset, ch)) = chars.next() {
+    for (offset, ch) in chars {
         if in_string {
             if escaped {
                 escaped = false;
@@ -933,8 +933,6 @@ mod tests {
         loader_handle.join().unwrap();
 
         // After the first load completes, a fresh attempt is allowed.
-        assert!(engine
-            .__test_run_with_lock_discipline(|| {})
-            .is_ok());
+        assert!(engine.__test_run_with_lock_discipline(|| {}).is_ok());
     }
 }