chore(desktop-backend): scope the unwrap_used deny to production code

.github/scripts/product_file_line_count_ratchet_baseline/desktop-rust.json

@@ -1,9 +1,9 @@
 {
   "files": {
-    "desktop/macos/Backend-Rust/src/routes/proxy.rs": 2803
+    "desktop/macos/Backend-Rust/src/routes/proxy.rs": 2806
   },
   "raise_justifications": {
-    "desktop/macos/Backend-Rust/src/routes/proxy.rs": "Streaming Gemini Vertex->AI Studio heal telemetry now derives its Recovered/Exhausted outcome from the upstream HTTP status (a testable stream_heal_outcome helper) instead of send-success, matching the non-streaming provider-switch telemetry; adds a unit test."
+    "desktop/macos/Backend-Rust/src/routes/proxy.rs": "Streaming Gemini Vertex->AI Studio heal telemetry now derives its Recovered/Exhausted outcome from the upstream HTTP status (a testable stream_heal_outcome helper) instead of send-success, matching the non-streaming provider-switch telemetry; adds a unit test. +3 for the test-module clippy::unwrap_used allow scoping the crate deny to production code."
   },
   "threshold": 1500
 }

desktop/macos/Backend-Rust/src/routes/chat/tests/all.rs

@@ -1,3 +1,7 @@
+// Tests may unwrap: the crate-level unwrap_used deny targets production
+// code; a test failing on unwrap is the test doing its job.
+#![allow(clippy::unwrap_used)]
+
 use super::*;
 
 use axum::{body::Bytes, http::StatusCode};

desktop/macos/Backend-Rust/src/routes/llm_stub.rs

@@ -1,4 +1,4 @@
 // Deterministic LLM responses for hermetic desktop E2E (OMI_LLM_STUB=1).
 //
 // Returns OpenAI-compatible SSE from fixture files instead of calling upstream
 // providers. Echoes any [[MARKER:...]] token found in the request body.
@@ -586,6 +586,9 @@
 
 #[cfg(test)]
 mod tests {
+    // Tests may unwrap: the crate-level unwrap_used deny targets production
+    // code; a test failing on unwrap is the test doing its job.
+    #![allow(clippy::unwrap_used)]
     use super::*;
     use crate::models::chat_completions::{
         ChatCompletionRequest, ChatMessage, FunctionDefinition, ToolDefinition,

desktop/macos/Backend-Rust/src/routes/proxy.rs

@@ -1,4 +1,4 @@
 // API proxy routes — forward Gemini requests to upstream APIs.
 // Keys stay server-side; desktop client authenticates via Firebase token only.
 //
 // Issue #5861: Remove client-side API key exposure risk.
@@ -1091,7 +1091,7 @@
 /// For embedContent/batchEmbedContents:
 ///   - Skip generation-specific validation (different schema)
 ///   - Strip safety_settings and cached_content only
 fn sanitize_gemini_body(body: &[u8], action: &str) -> Result<Vec<u8>, String> {
     let mut json: serde_json::Value =
         serde_json::from_slice(body).map_err(|e| format!("invalid JSON: {}", e))?;
 
@@ -1356,6 +1356,9 @@
 
 #[cfg(test)]
 mod tests {
+    // Tests may unwrap: the crate-level unwrap_used deny targets production
+    // code; a test failing on unwrap is the test doing its job.
+    #![allow(clippy::unwrap_used)]
     use super::*;
     use tokio::io::{AsyncReadExt, AsyncWriteExt};
     use tokio::net::{TcpListener, TcpStream};

desktop/macos/Backend-Rust/src/routes/updates.rs

@@ -428,8 +428,20 @@ async fn promote_release(
     }
 }
 
+pub fn updates_routes() -> Router<AppState> {
+    Router::new()
+        .route("/appcast.xml", get(get_appcast))
+        .route("/updates/latest", get(get_latest_version))
+        .route("/updates/releases", post(create_release))
+        .route("/updates/releases/promote", patch(promote_release))
+        .route("/download", get(download_redirect))
+}
+
 #[cfg(test)]
 mod tests {
+    // Tests may unwrap: the crate-level unwrap_used deny targets production
+    // code; a test failing on unwrap is the test doing its job.
+    #![allow(clippy::unwrap_used)]
     use super::*;
 
     fn make_release(
@@ -567,12 +579,3 @@ mod tests {
         );
     }
 }
-
-pub fn updates_routes() -> Router<AppState> {
-    Router::new()
-        .route("/appcast.xml", get(get_appcast))
-        .route("/updates/latest", get(get_latest_version))
-        .route("/updates/releases", post(create_release))
-        .route("/updates/releases/promote", patch(promote_release))
-        .route("/download", get(download_redirect))
-}

desktop/macos/Backend-Rust/src/routes/webhooks.rs

@@ -485,7 +485,7 @@
 /// POST /v1/webhooks/sentry/poll - Poll Sentry for new feedback and create action items
 /// This is needed because Sentry webhooks don't fire for feedback category issues
 /// (see https://github.com/getsentry/sentry/issues/89436)
 async fn poll_sentry_feedback(State(state): State<AppState>) -> Result<Json<Value>, StatusCode> {
     let admin_uid = state.config.sentry_admin_uid.as_deref().ok_or_else(|| {
         tracing::error!("Sentry poll: SENTRY_ADMIN_UID not configured");
         StatusCode::INTERNAL_SERVER_ERROR
@@ -724,6 +724,9 @@
 
 #[cfg(test)]
 mod tests {
+    // Tests may unwrap: the crate-level unwrap_used deny targets production
+    // code; a test failing on unwrap is the test doing its job.
+    #![allow(clippy::unwrap_used)]
     use super::*;
 
     #[test]