Take rustfmt's defaults

The code was hand-formatted -- close to rustfmt's output but not it, mostly
in keeping chains and call arguments on one line where the formatter would
break them. That is a per-line decision every future change has to make
again, and reproducing it would mean a config whose only job is to preserve
how the code already looks.

So this is `cargo fmt` at its defaults, with no rustfmt.toml, which is
where the sibling dev-updater checkout already sits: it is clean at the
defaults today, so the two repos now agree on layout without either of them
configuring it.

Formatting only -- no behaviour, no renames, nothing reordered. Verified
after: cargo test (35 pass), cargo clippy --all-targets clean, cargo fmt
--check clean.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017xn8nHw1tw1R6PtiY1eEtw

server/src/certs.rs

@@ -73,14 +73,22 @@ pub fn ensure(dir: &Path, addresses: &[IpAddr]) -> Result<Certificates> {
     private::write_file(&leaf_key, leaf_key_pem.as_bytes())?;
     private::write_file(&leaf_cert, leaf_pem.as_bytes())?;
 
-    Ok(Certificates { leaf_cert, leaf_key, ca_is_new })
+    Ok(Certificates {
+        leaf_cert,
+        leaf_key,
+        ca_is_new,
+    })
 }
 
 fn generate_ca() -> Result<(String, String)> {
     let key = KeyPair::generate().context("generate CA key")?;
     let mut params = CertificateParams::default();
-    params.distinguished_name.push(DnType::OrganizationName, "ai-app dev");
-    params.distinguished_name.push(DnType::CommonName, "ai-app dev CA");
+    params
+        .distinguished_name
+        .push(DnType::OrganizationName, "ai-app dev");
+    params
+        .distinguished_name
+        .push(DnType::CommonName, "ai-app dev CA");
     params.is_ca = IsCa::Ca(BasicConstraints::Unconstrained);
     // Explicit, because strict verifiers reject a CA without them -- and
     // that rejection surfaces as an opaque handshake failure on a phone.
@@ -89,20 +97,21 @@ fn generate_ca() -> Result<(String, String)> {
     Ok((certificate.pem(), key.serialize_pem()))
 }
 
-fn generate_leaf(
-    ca_pem: &str,
-    ca_key_pem: &str,
-    addresses: &[IpAddr],
-) -> Result<(String, String)> {
+fn generate_leaf(ca_pem: &str, ca_key_pem: &str, addresses: &[IpAddr]) -> Result<(String, String)> {
     let ca_key = KeyPair::from_pem(ca_key_pem).context("read CA key")?;
     let issuer = Issuer::from_ca_cert_pem(ca_pem, ca_key).context("read CA certificate")?;
 
     let key = KeyPair::generate().context("generate leaf key")?;
     let mut params = CertificateParams::default();
-    params.distinguished_name.push(DnType::OrganizationName, "ai-app dev");
+    params
+        .distinguished_name
+        .push(DnType::OrganizationName, "ai-app dev");
     params.distinguished_name.push(
         DnType::CommonName,
-        addresses.first().map(|a| a.to_string()).unwrap_or_else(|| "ai-app".to_string()),
+        addresses
+            .first()
+            .map(|a| a.to_string())
+            .unwrap_or_else(|| "ai-app".to_string()),
     );
     params.subject_alt_names = addresses.iter().map(|a| SanType::IpAddress(*a)).collect();
     params.is_ca = IsCa::ExplicitNoCa;
@@ -135,10 +144,16 @@ mod tests {
         // The CA is the pinned one: replacing it would strand every
         // installed app, so it must survive a restart untouched.
         assert!(!second.ca_is_new);
-        assert_eq!(ca, std::fs::read_to_string(dir.path().join("ca.pem")).expect("ca"));
+        assert_eq!(
+            ca,
+            std::fs::read_to_string(dir.path().join("ca.pem")).expect("ca")
+        );
         // The leaf is not pinned, and is reissued so a new address is just
         // a restart away.
-        assert_ne!(leaf, std::fs::read_to_string(&second.leaf_cert).expect("leaf"));
+        assert_ne!(
+            leaf,
+            std::fs::read_to_string(&second.leaf_cert).expect("leaf")
+        );
     }
 
     #[test]
@@ -146,7 +161,11 @@ mod tests {
         let dir = tempfile::tempdir().expect("tempdir");
         let certs = ensure(dir.path(), &addresses()).expect("generate");
         assert_eq!(
-            std::fs::metadata(dir.path()).expect("dir").permissions().mode() & 0o777,
+            std::fs::metadata(dir.path())
+                .expect("dir")
+                .permissions()
+                .mode()
+                & 0o777,
             0o700,
         );
         for file in ["ca.pem", "ca-key.pem", "leaf.pem", "leaf-key.pem"] {