fix: resolve all code quality issues from #108 review

[intendednull]

Summary

Resolves all open child issues from the #108 code quality review. Eight feature branches were developed in parallel in isolated git worktrees, merged into this integration branch, and verified by 7 audit agents covering security, test coverage, performance/design, and full-codebase review.

CI Status — all green

Check	Result
Format	SUCCESS
Clippy	SUCCESS
Test	SUCCESS
WASM Check	SUCCESS

Changes by issue

Issue	Change
#117	Sign WorkerWireMessage with Ed25519 — all worker gossip messages now wrapped in WireMessage::Worker and signed via pack_wire/unpack_wire; unsigned/tampered messages rejected
#119	Remove dead connection_events() stub from Network trait and both implementations
#120	Add RatchetCache — hybrid BTreeMap + saved-ratchet-state cache that eliminates O(counter) replay on repeated key derivation; bounded by max_entries
#121	Replace O(N²) sort-on-insert in InMemoryStore with BTreeMap<HlcTimestamp, Vec<MessageId>> — O(log N) insert, naturally sorted iteration
#122	Add HashMap<EventHash, usize> index to ServerState for O(1) EditMessage/DeleteMessage/Reaction lookups
#123	Capture evict_to return value in PendingBuffer and emit tracing::warn! when events are dropped
#128/#129	Replace all browser-API .unwrap() calls in voice.rs, file_share.rs, call_page.rs with graceful let Some/let Ok early-returns
#130	Add with_timeout(label, future) utility and wrap hot-path actor calls in mutations.rs/accessors.rs with 5-second timeout + tracing::warn on fire
#131	Enable clippy::let_underscore_must_use = "deny" workspace-wide; fix all violations across the workspace
#141	Fix reconcile_topic_map to skip malformed channel IDs with a warning instead of generating random UUIDs (which would split-brain the client from the network)
#124/#125	Confirmed N/A — crates/app no longer exists in the workspace

Fixes discovered during audit and applied

• voice.rs:531 — stray .unwrap() on HashMap::get() after insertion (→ .expect("key just inserted"))
• worker_types.rs security doc comment updated to reflect Ed25519 signing
• message_index type corrected from BTreeMap to HashMap for true O(1) lookup
• derive_or_cached — added target_counter=0 guard preventing latent infinite loop on "no ratchet" sentinel
• with_timeout — moved per-step ratchet clone to final loop step only (avoids redundant clones)
• client/util.rs WASM build — suppress unused label variable warning

Security findings filed as follow-up issues

• security: verify WorkerAnnouncement.peer_id against Ed25519 signer #144 — WorkerAnnouncement.peer_id not verified against Ed25519 signer (no live impact today; WireMessage::Worker arm is a no-op in client listeners)
• security: UserProfile broadcasts are unsigned — display names can be spoofed #145 — UserProfile broadcasts are unsigned — display names can be spoofed (pre-existing)

Test coverage added

New tests across 5 crates covering:

• WireMessage::Worker round-trip pack/unpack and tampered-signature rejection
• RatchetCache counter=0 sentinel, backwards-counter request, epoch isolation, eviction, and size bound
• DeleteMessage via message_index (O(1) path)
• with_timeout fires on stall (native)
• reconcile_topic_map drops malformed IDs and preserves valid ones
• BTreeMap channel store: HLC ordering after random insertion, duplicate HLC timestamps handled

All 33 test suites pass with zero failures.

Test plan

• cargo test --workspace --exclude willow-web — 0 failures across 33 suites
• cargo clippy --workspace --exclude willow-web -- -D warnings — 0 warnings
• cargo check --target wasm32-unknown-unknown -p willow-web — clean
• cargo fmt --check — clean

Closes #108, #117, #119, #120, #121, #122, #123, #128, #129, #130, #131, #141