Tighten clippy gate to --all-targets --all-features and clean up

The local ci-local.sh and the GitHub CI clippy invocations both used
`cargo clippy --all -- -D warnings`, which only checks lib + bin
targets. Test code, integration tests, and benches were not lint-gated.
Three pre-existing clippy errors lurked in test modules as a result
(two field_reassign_with_default in config tests, one
items_after_test_module in stun.rs).

Tighten both invocations to `cargo clippy --all-targets --all-features
-- -D warnings` so the gate covers everything cargo can build, and
fix the three exposed errors:

- src/config/mod.rs: rewrite two test-only `Config::default()` +
  field-reassign sites to struct-update syntax.
- src/discovery/nostr/stun.rs: move helper `random_txn_id` above the
  `#[cfg(test)] mod tests` block.

Also adds a dedicated Clippy job to the GitHub CI workflow so the
strict gate runs on every PR (the workflow had no clippy job before;
clippy ran only via testing/ci-local.sh on operator machines).

No behavior changes; lint hygiene + CI hardening only.

.github/workflows/ci.yml

@@ -36,6 +36,28 @@ jobs:
           components: rustfmt
       - run: cargo fmt --check
 
+  clippy:
+    name: Clippy
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install system dependencies
+        run: sudo apt-get update && sudo apt-get install -y libdbus-1-dev
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy
+      - name: Cache Cargo registry + build
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+          key: ${{ runner.os }}-cargo-clippy-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-cargo-
+      - run: cargo clippy --all-targets --all-features -- -D warnings
+
   build:
     name: Build (${{ matrix.os }})
     runs-on: ${{ matrix.os }}

src/config/mod.rs

@@ -1293,12 +1293,14 @@ peers:
 
     #[test]
     fn test_validate_peer_via_nostr_requires_nostr_enabled() {
-        let mut config = Config::default();
+        let mut config = Config {
-        config.peers = vec![PeerConfig {
+            peers: vec![PeerConfig {
                 npub: "npub1peer".to_string(),
                 via_nostr: true,
                 ..Default::default()
-        }];
+            }],
+            ..Default::default()
+        };
         config.node.discovery.nostr.enabled = false;
 
         let err = config.validate().expect_err("validation should fail");
@@ -1308,11 +1310,13 @@ peers:
     #[test]
     fn test_validate_peer_addresses_required_unless_via_nostr() {
         // Empty addresses + via_nostr=false → error.
-        let mut config = Config::default();
+        let mut config = Config {
-        config.peers = vec![PeerConfig {
+            peers: vec![PeerConfig {
                 npub: "npub1peer".to_string(),
                 ..Default::default()
-        }];
+            }],
+            ..Default::default()
+        };
         let err = config.validate().expect_err("validation should fail");
         assert!(err.to_string().contains("at least one address"));
 

src/discovery/nostr/stun.rs

@@ -344,6 +344,14 @@ fn push_ip(addresses: &mut Vec<String>, ip: IpAddr) {
     }
 }
 
+fn random_txn_id() -> [u8; 12] {
+    let mut txn_id = [0u8; 12];
+    for byte in &mut txn_id {
+        *byte = rand::random::<u8>();
+    }
+    txn_id
+}
+
 #[cfg(test)]
 mod tests {
     use super::is_private_overlay_candidate_ip;
@@ -381,11 +389,3 @@ mod tests {
         )));
     }
 }
-
-fn random_txn_id() -> [u8; 12] {
-    let mut txn_id = [0u8; 12];
-    for byte in &mut txn_id {
-        *byte = rand::random::<u8>();
-    }
-    txn_id
-}

testing/ci-local.sh

@@ -193,8 +193,8 @@ run_build() {
         return 1
     fi
 
-    info "cargo clippy --all -- -D warnings"
+    info "cargo clippy --all-targets --all-features -- -D warnings"
-    if cargo clippy --all -- -D warnings 2>&1; then
+    if cargo clippy --all-targets --all-features -- -D warnings 2>&1; then
         record "clippy" 0
     else
         record "clippy" 1