Tighten clippy gate to --all-targets --all-features and clean up

The local ci-local.sh and the GitHub CI clippy invocations both used
`cargo clippy --all -- -D warnings`, which only checks lib + bin
targets. Test code, integration tests, and benches were not lint-gated.
Three pre-existing clippy errors lurked in test modules as a result
(two field_reassign_with_default in config tests, one
items_after_test_module in stun.rs).

Tighten both invocations to `cargo clippy --all-targets --all-features
-- -D warnings` so the gate covers everything cargo can build, and
fix the three exposed errors:

- src/config/mod.rs: rewrite two test-only `Config::default()` +
  field-reassign sites to struct-update syntax.
- src/discovery/nostr/stun.rs: move helper `random_txn_id` above the
  `#[cfg(test)] mod tests` block.

Also adds a dedicated Clippy job to the GitHub CI workflow so the
strict gate runs on every PR (the workflow had no clippy job before;
clippy ran only via testing/ci-local.sh on operator machines).

No behavior changes; lint hygiene + CI hardening only.

testing/ci-local.sh

@@ -193,8 +193,8 @@ run_build() {
         return 1
     fi
 
-    info "cargo clippy --all -- -D warnings"
-    if cargo clippy --all -- -D warnings 2>&1; then
+    info "cargo clippy --all-targets --all-features -- -D warnings"
+    if cargo clippy --all-targets --all-features -- -D warnings 2>&1; then
         record "clippy" 0
     else
         record "clippy" 1