fix: count_bounded error counting, clippy if-let, auth test dedup, doc tests

- count_bounded: break on iterator error instead of counting errors as tokens
- collapse nested if-let chains with let-chains in auth middleware
- document JWT/Basic Auth as mutually exclusive
- TailTokensFilter::clone uses empty buffer (always pre-filter)
- fix 9 broken doc examples in server/common.rs
- remove 7 duplicate auth tests from auth.rs (covered by auth_tests.rs)

src/modes/server/auth.rs

@@ -116,116 +116,3 @@ pub fn validate_jwt(token: &str, secret: &str) -> Result<Claims, String> {
 
     Ok(token_data.claims)
 }
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use jsonwebtoken::{EncodingKey, Header, encode};
-
-    fn make_token(claims: &serde_json::Value, secret: &str) -> String {
-        let header = Header::new(jsonwebtoken::Algorithm::HS256);
-        encode(
-            &header,
-            claims,
-            &EncodingKey::from_secret(secret.as_bytes()),
-        )
-        .unwrap()
-    }
-
-    #[test]
-    fn test_validate_jwt_valid_token() {
-        let secret = "test-secret";
-        let claims = serde_json::json!({
-            "sub": "test-client",
-            "exp": 9999999999usize,
-            "read": true,
-            "write": true,
-            "delete": false
-        });
-        let token = make_token(&claims, secret);
-
-        let result = validate_jwt(&token, secret);
-        assert!(result.is_ok());
-        let claims = result.unwrap();
-        assert_eq!(claims.sub, "test-client");
-        assert!(claims.read);
-        assert!(claims.write);
-        assert!(!claims.delete);
-    }
-
-    #[test]
-    fn test_validate_jwt_expired_token() {
-        let secret = "test-secret";
-        let claims = serde_json::json!({
-            "sub": "test-client",
-            "exp": 1000000000usize,
-            "read": true
-        });
-        let token = make_token(&claims, secret);
-
-        let result = validate_jwt(&token, secret);
-        assert!(result.is_err());
-        assert_eq!(result.unwrap_err(), "Token expired");
-    }
-
-    #[test]
-    fn test_validate_jwt_wrong_secret() {
-        let claims = serde_json::json!({
-            "sub": "test-client",
-            "exp": 9999999999usize,
-            "read": true
-        });
-        let token = make_token(&claims, "correct-secret");
-
-        let result = validate_jwt(&token, "wrong-secret");
-        assert!(result.is_err());
-    }
-
-    #[test]
-    fn test_validate_jwt_malformed_token() {
-        let result = validate_jwt("not.a.jwt", "secret");
-        assert!(result.is_err());
-    }
-
-    #[test]
-    fn test_required_permission() {
-        assert_eq!(required_permission(&Method::GET), "read");
-        assert_eq!(required_permission(&Method::HEAD), "read");
-        assert_eq!(required_permission(&Method::POST), "write");
-        assert_eq!(required_permission(&Method::PUT), "write");
-        assert_eq!(required_permission(&Method::PATCH), "write");
-        assert_eq!(required_permission(&Method::DELETE), "delete");
-    }
-
-    #[test]
-    fn test_check_permission() {
-        let claims = Claims {
-            sub: "test".to_string(),
-            exp: 9999999999,
-            read: true,
-            write: false,
-            delete: true,
-        };
-
-        assert!(check_permission(&claims, "read"));
-        assert!(!check_permission(&claims, "write"));
-        assert!(check_permission(&claims, "delete"));
-        assert!(!check_permission(&claims, "unknown"));
-    }
-
-    #[test]
-    fn test_check_permission_default_false() {
-        // When fields are missing from JSON, serde(default) makes them false
-        let secret = "test-secret";
-        let claims = serde_json::json!({
-            "sub": "test-client",
-            "exp": 9999999999usize
-        });
-        let token = make_token(&claims, secret);
-
-        let claims = validate_jwt(&token, secret).unwrap();
-        assert!(!claims.read);
-        assert!(!claims.write);
-        assert!(!claims.delete);
-    }
-}