chore: adopt workspace lints, declare MSRV, lint Workers crates in CI

[alukach]

What I'm changing

The workspace had no lint configuration beyond clippy's defaults, no declared minimum Rust version, and no # Panics or # Errors doc sections anywhere. About 90 public items (mostly struct fields and enum variants in types.rs, api/response.rs, and the STS response types) had no doc comment, and roughly 15 unwrap() calls remained in production paths after #152. Separately, the two Cloudflare Workers crates are excluded from default-members, so the CI clippy job has never linted them.

This PR turns on missing_docs and clippy::unwrap_used at the workspace level, documents and de-unwraps everything needed to make them clean, declares the MSRV, and adds a wasm clippy step to CI.

Stacked on #152 (which removes the header-value unwraps this lint would otherwise flag).

How I did it

Two commits so each is green on its own: the source changes first (inert without the lint), then the configuration that enforces them.

• Root Cargo.toml: [workspace.lints.rust] missing_docs = "warn" and [workspace.lints.clippy] unwrap_used = "warn". CI's -D warnings promotes both to errors. rust-version = "1.89" is the floor set by crc-fast (via object_store); verified locally with cargo +1.89 check on the native workspace.
• Every crate Cargo.toml: [lints] workspace = true.
• clippy.toml: allow-unwrap-in-tests = true. This covers #[test] fns and #[cfg(test)] modules but not helper fns in tests/*.rs integration crates, so those three files carry a crate-level #![allow(clippy::unwrap_used)] with a comment saying why.
• Docs: one-line /// on each undocumented field, variant, and fn. Router::route gets a # Panics section (it panics on a conflicting route; previously stated only in prose). Router::new, MaybeSend/MaybeSync, HostStyle, JwksCache, TemporaryCredentialResolver::resolve, and the OidcProviderError variants get real docs.
• Unwrap removal:
  • JwksCache (crates/sts/src/jwks.rs): a private lock() helper recovers from a poisoned mutex via into_inner(), since the maps only hold cached data.
  • OidcBackendAuth::handle (crates/oidc-provider/src/backend_auth.rs): take() the bucket config out of the context instead of if let Some(ref ..) followed by .unwrap() on the same field.
  • crates/cf-workers/src/response.rs: response construction falls back to a 500 instead of unwrapping the JS result.
  • sts::matches_glob: parts.last().copied().unwrap_or("").
  • Response builders in the server and lambda examples: expect with a message stating that the status and headers came from an already-valid HTTP exchange.
• examples/cf-workers/src/bandwidth.rs: module-level #![allow(missing_docs)] because the #[durable_object] macro expands to undocumented wasm-bindgen glue that a struct-level allow does not reach.
• crates/core/src/auth/tests.rs: #[allow(clippy::too_many_arguments)] on the SigV4 test helper, a pre-existing warning that made cargo clippy --all-targets red.
• .github/workflows/ci.yml: the wasm job now also runs cargo clippy -p multistore-cf-workers -p multistore-cf-workers-example --target wasm32-unknown-unknown -- -D warnings. Makefile gains clippy-wasm (wired into ci-fast) and CONTRIBUTING.md documents the lints and MSRV policy.

Not changed: the four pre-existing rustdoc warnings from cargo doc (a private-item link and two unresolved links) are out of scope here.

Test plan

• cargo clippy -- -D warnings (CI form)
• cargo clippy --all-targets -- -D warnings
• cargo clippy -p multistore-cf-workers -p multistore-cf-workers-example --target wasm32-unknown-unknown -- -D warnings
• cargo test — 293 passed, 0 failed
• cargo +1.89 check on the native workspace
• cargo fmt --check

🤖 Generated with Claude Code

[claude]

Claude finished @alukach's task in 57s —— View job

---

✅ No blocking issues — safe to merge.

Reviewed the full diff against origin/fix/header-values (Cargo.toml/lint config, all unwrap→expect/fallback conversions, and every doc-comment addition).

• Unwrap removals are all sound: JwksCache's new lock() helper correctly recovers from mutex poisoning (the maps only hold cache data, so this is safe) and is applied consistently across all four call sites in crates/sts/src/jwks.rs. subject_matches's parts.last().copied().unwrap_or("") in crates/sts/src/lib.rs:222 is unreachable-but-safe since split always yields ≥1 element. The ctx.bucket_config.take() refactor in crates/oidc-provider/src/backend_auth.rs correctly restores ctx.bucket_config on the non-OIDC path (the else branch) — verified against the full function body, behavior is preserved. web_sys::Response fallbacks in crates/cf-workers/src/response.rs degrade to a 500/502 without recursion risk.

• All expect() messages accurately describe the invariant they document (e.g. "backend status and headers are already valid HTTP" in the server/lambda examples).

• Doc additions are accurate and appropriately terse, with one exception (non-blocking, doesn't affect behavior):

  crates/core/src/maybe_send.rs:36 — the wasm32 MaybeSync trait's doc comment is copy-pasted from MaybeSend and says `Send` on native targets, no bound on wasm32. instead of Sync:

  /// `Sync` on native targets, no bound on wasm32.
  #[cfg(target_arch = "wasm32")]
  pub trait MaybeSync {}

• Config changes (missing_docs/unwrap_used workspace lints, MSRV, clippy.toml, CI wasm clippy job, Makefile target) are mechanical and consistent across all 12 crate Cargo.toml files.

Simplify (ponytail)

Nothing to flag — this PR is lint/doc/config plumbing with no new abstractions, dependencies, or reinvented logic. The one small addition (JwksCache's private lock() helper) is a justified 3-line dedup of a pattern repeated 4 times, not speculative.

---

💰 Estimated review cost: $0.40 · 0m56s · 16 turns

[github-actions]

🚀 Latest commit deployed to https://multistore-proxy-pr-154.development-seed.workers.dev

• Date: 2026-09-25T06:04:17Z
• Commit: 4811d66