Server gate: cargo audit

The server gate becomes cargo fmt --check && cargo clippy --all-targets -- -D warnings && cargo audit && cargo test
(CLAUDE.md, server/README.md). The pre-commit hook runs cargo audit --no-fetch only when server/Cargo.lock or a
server Cargo.toml is staged, and skips with a message when cargo-audit or the advisory database is missing.
First run: 0 advisories, 0 warnings over 319 crates; no audit.toml needed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B

tools/git-hooks/pre-commit

@@ -31,3 +31,20 @@ if [ -f "$top/server/Cargo.toml" ] && [ -d "$top/server/crates/kvitt-domain" ] &
     exit 1
   }
 fi
+
+# Server: cargo audit, only when a dependency changed (server/Cargo.lock or a Cargo.toml staged), so ordinary
+# commits stay fast. Offline (--no-fetch: the advisory database in ~/.cargo/advisory-db as last fetched by the gate).
+# A missing cargo-audit or a database never fetched skips the check with a message; it never fails the commit.
+if [ -f "$top/server/Cargo.lock" ] && git -C "$top" diff --cached --name-only -- 'server/Cargo.lock' 'server/Cargo.toml' \
+  'server/**/Cargo.toml' | grep -q .; then
+  if ! command -v cargo-audit >/dev/null 2>&1; then
+    echo "pre-commit: cargo-audit is not installed; skipping the dependency audit (cargo install cargo-audit --locked)." >&2
+  elif [ ! -d "${CARGO_HOME:-$HOME/.cargo}/advisory-db" ]; then
+    echo "pre-commit: no advisory database yet; skipping the dependency audit (run cargo audit once from server/)." >&2
+  else
+    (cd "$top/server" && cargo audit --no-fetch --quiet) || {
+      echo "pre-commit: cargo audit found advisories in server/Cargo.lock (see above). Fix them, or see server/README.md." >&2
+      exit 1
+    }
+  fi
+fi