Server gate: cargo audit

The server gate becomes cargo fmt --check && cargo clippy --all-targets -- -D warnings && cargo audit && cargo test
(CLAUDE.md, server/README.md). The pre-commit hook runs cargo audit --no-fetch only when server/Cargo.lock or a
server Cargo.toml is staged, and skips with a message when cargo-audit or the advisory database is missing.
First run: 0 advisories, 0 warnings over 319 crates; no audit.toml needed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B

server/README.md

@@ -120,7 +120,18 @@ the wire contract makes `tests/openapi_contract.rs` fail against `contracts/open
 
 ## Tests and the gate
 
-From `server/`: `cargo fmt --check && cargo clippy --all-targets -- -D warnings && cargo test`.
+From `server/`: `cargo fmt --check && cargo clippy --all-targets -- -D warnings && cargo audit && cargo test`.
+
+`cargo audit` (cargo-audit 0.22.2, `cargo install cargo-audit --locked`) checks `Cargo.lock` against the RustSec
+advisory database. It needs the network: each run fetches the database into `~/.cargo/advisory-db` (and the
+crates.io index). Run the gate online at least once per machine so the database exists; offline,
+`cargo audit --no-fetch` uses the copy already there. A fix is a semver-compatible bump
+(`cargo update -p <crate>`); an advisory without a fix goes in `server/.cargo/audit.toml` under
+`[advisories] ignore` with a dated comment and is an owner decision.
+
+The pre-commit hook (`tools/git-hooks/pre-commit`) runs `cargo audit --no-fetch` only when `server/Cargo.lock` or a
+`Cargo.toml` under `server/` is staged, so ordinary commits stay fast. When `cargo-audit` is not installed or the
+database was never fetched it prints a message and skips the check; it never fails a commit for a missing tool.
 
 * `crates/kvitt-domain/tests/vectors.rs`: every case of every file in `contracts/test-vectors/` (the two
   Kotlin-only analytics files are parsed and skipped).