fix(mounts): post-merge fmt + audit + minimal lockfile

- rustfmt the integration-test FolderService::new callsites added during
  the upstream merge (long single-line args wrapped).
- Cargo.lock: rebuild from upstream/main's lock so only the
  testcontainers-modules dev-dep subtree and the memmap2 0.9.10→0.9.11
  security bump differ (avoids churning upstream's pins).
- .cargo/audit.toml: ignore the four astral-tokio-tar tar-extraction
  advisories — dev-only, transitive via testcontainers-modules
  (integration-test harness), never in the production binary.

.cargo/audit.toml

@@ -39,4 +39,20 @@ ignore = [
     #   RUSTSEC-2026-0194: quadratic dup-attribute check → CPU-DoS
     "RUSTSEC-2026-0195",
     "RUSTSEC-2026-0194",
+
+    # astral-tokio-tar 0.5.6 — tar extraction advisories, transitive via
+    # testcontainers → testcontainers-modules, a DEV-dependency used only by
+    # the `--cfg integration_tests` harness to spin up throwaway Postgres
+    # containers. Never compiled into the production binary and never fed
+    # attacker-controlled tar input — the only archives extracted are the
+    # official Postgres images the test harness pulls. testcontainers 0.25.2
+    # pins astral-tokio-tar to ^0.5, so the fixed 0.6.x is not reachable
+    # without a testcontainers major bump (tracked separately).
+    #   RUSTSEC-2026-0145 / -0112: PAX header desynchronization
+    #   RUSTSEC-2026-0113: unpack_in symlink-following chmod
+    #   RUSTSEC-2026-0066: insufficient PAX extension validation (low)
+    "RUSTSEC-2026-0145",
+    "RUSTSEC-2026-0112",
+    "RUSTSEC-2026-0113",
+    "RUSTSEC-2026-0066",
 ]

src/application/services/folder_service.rs

@@ -1664,7 +1664,9 @@ mod mount_authz_integration {
         let fs = FolderService::new(
             Arc::new(FolderDbRepository::new(pool.clone())),
             acl(pool),
-            Arc::new(crate::application::services::file_lifecycle_service::FileLifecycleService::new()),
+            Arc::new(
+                crate::application::services::file_lifecycle_service::FileLifecycleService::new(),
+            ),
             router,
         );
         (fs, p.mount_folder_id.to_string(), p.owner_id)
@@ -1860,7 +1862,9 @@ mod mount_authz_integration {
         let folder_service = FolderService::new(
             Arc::new(FolderDbRepository::new(pool.clone())),
             acl(&pool),
-            Arc::new(crate::application::services::file_lifecycle_service::FileLifecycleService::new()),
+            Arc::new(
+                crate::application::services::file_lifecycle_service::FileLifecycleService::new(),
+            ),
             router.clone(),
         );
         let retrieval = FileRetrievalService::new_with_authz_for_test(
@@ -1910,7 +1914,12 @@ mod mount_authz_integration {
 
         // PROPFIND Depth:1 file loop: list files of the mount root.
         let files = retrieval
-            .list_files_batch_with_perms(Some(&p.mount_folder_id.to_string()), p.owner_id, None, 100)
+            .list_files_batch_with_perms(
+                Some(&p.mount_folder_id.to_string()),
+                p.owner_id,
+                None,
+                100,
+            )
             .await
             .expect("list mount files");
         assert_eq!(
@@ -1995,7 +2004,9 @@ mod mount_authz_integration {
         let folder_service = FolderService::new(
             Arc::new(FolderDbRepository::new(pool.clone())),
             acl(&pool),
-            Arc::new(crate::application::services::file_lifecycle_service::FileLifecycleService::new()),
+            Arc::new(
+                crate::application::services::file_lifecycle_service::FileLifecycleService::new(),
+            ),
             router.clone(),
         );