dev: Use expect rather than allow (#184)

To prevent stale `#[allow(...)]`s, this PR configures `clippy` to reject
them in favour of the `#[expect(..., reason="...")]` attribute.

In the process, it performs a few clean-ups:
- All `allow`s for panic/expect/unwrap in tests are removed. They are
unnecessary, given our clippy.toml file:
  ```toml
  allow-unwrap-in-tests = true
  allow-expect-in-tests = true
  allow-panic-in-tests = true
  ```
- (Plausible) reasons are added where they were missing
- All lints are set to `warn`. No need to use `deny`, since we fail on
warnings in CI.

Author: LukeMathWalker

Cargo.toml

@@ -20,15 +20,16 @@ license = "Apache-2.0"
 repository = "https://github.com/Firma-AI/openfirma"
 
 [workspace.lints.clippy]
-pedantic = { level = "deny", priority = -1 }
+pedantic = { level = "warn", priority = -1 }
 nursery = { level = "warn", priority = -1 }
-unwrap_used = "deny"
-expect_used = "deny"
-panic = "deny"
+unwrap_used = "warn"
+expect_used = "warn"
+panic = "warn"
 missing_const_for_fn = "allow"
+allow_attributes = "warn"
 
 [workspace.lints.rust]
-unsafe_code = "deny"
+unsafe_code = "warn"
 
 [workspace.dependencies]
 anyhow = "1"

crates/firma-authority/src/authorized_clients.rs

@@ -94,7 +94,10 @@ struct AuthorizedClientsFile {
 }
 
 #[derive(Deserialize)]
-#[allow(dead_code)]
+#[expect(
+    dead_code,
+    reason = "backward-compatible TOML schema accepts metadata fields that serde deserializes even when the loader ignores them"
+)]
 struct AuthorizedEntry {
     #[serde(default)]
     cn: Option<String>,
@@ -112,7 +115,6 @@ struct ClientEntry {
 }
 
 #[cfg(test)]
-#[allow(clippy::unwrap_used, clippy::panic)]
 mod tests {
     use super::*;
     use std::io::Write as _;

crates/firma-authority/src/cedar_loader.rs

@@ -326,7 +326,6 @@ fn compute_version_hash(policies: &str, schema: &str) -> String {
 }
 
 #[cfg(test)]
-#[allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
 mod tests {
     use super::*;
     use std::fs;

crates/firma-authority/src/config.rs

@@ -283,7 +283,6 @@ pub enum ConfigError {
 }
 
 #[cfg(test)]
-#[allow(clippy::unwrap_used, clippy::panic)]
 mod tests {
     use super::*;
 

crates/firma-authority/src/issuance.rs

@@ -109,7 +109,6 @@ pub async fn issue_capability(
 }
 
 #[cfg(test)]
-#[allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
 mod tests {
     use super::*;
     use pasetors::keys::{AsymmetricKeyPair, Generate};

crates/firma-authority/src/revocation.rs

@@ -424,7 +424,6 @@ impl RevocationStoreWatcher {
 }
 
 #[cfg(test)]
-#[allow(clippy::unwrap_used, clippy::panic)]
 mod tests {
     use super::*;
 

crates/firma-authority/src/server.rs

@@ -239,7 +239,10 @@ where
 // Per-mode server future builders
 // ---------------------------------------------------------------------------
 
-#[allow(clippy::too_many_arguments)]
+#[expect(
+    clippy::too_many_arguments,
+    reason = "mTLS server construction needs explicit TLS paths, services, listener, and shutdown signal"
+)]
 async fn build_mtls_future<F, H>(
     cert_path: &Path,
     key_path: &Path,

crates/firma-authority/src/service.rs

@@ -528,7 +528,6 @@ pub(crate) fn clamp_ttl(requested: i32, max: i32) -> i32 {
 }
 
 #[cfg(test)]
-#[allow(clippy::unwrap_used, clippy::panic)]
 mod tests {
     use super::*;
 

crates/firma-authority/src/startup/log_contract.rs

@@ -39,7 +39,6 @@ pub fn log_ready_sequence(report: &StartupReport<'_>) {
 }
 
 #[cfg(test)]
-#[allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
 mod tests {
     use super::*;
     use std::path::PathBuf;

crates/firma-authority/src/tls_verifier.rs

@@ -158,7 +158,6 @@ fn extract_identity(cert_der: &CertificateDer<'_>) -> Option<String> {
 }
 
 #[cfg(test)]
-#[allow(clippy::unwrap_used, clippy::panic, clippy::expect_used)]
 mod tests {
     use super::*;
     fn make_allow_list(ids: &[&str]) -> Arc<AuthorizedClientSet> {