fix: replace silent native-tls fallbacks with expect()

Review finding: unwrap_or_else(|_| reqwest::Client::new()) silently
reverts to native-tls if rustls builder fails, defeating the TLS fix.
Replace with expect() since rustls builder should never fail in
practice. Also includes linter cleanups.

hanzo-dev/core/src/auth.rs

@@ -1027,10 +1027,8 @@ pub struct AuthDotJson {
 // Shared constant for token refresh (client id used for oauth token refresh flow).
 // For Hanzo IAM (hanzo.id), this is the `app-dev` application.
 // For OpenAI (--chatgpt), pass the OpenAI client ID via --client-id.
+// Hanzo IAM public client (PKCE only, no client_secret)
 pub const CLIENT_ID: &str = "app-hanzo";
-/// Publishable key for the Hanzo IAM OAuth flow. This is a public key (like
-/// Stripe's `pk_*` keys) and is safe to embed in client applications.
-pub const PUBLISHABLE_KEY: &str = "";
 
 use std::sync::RwLock;
 

hanzo-dev/login/src/server.rs

@@ -450,19 +450,16 @@ pub(crate) async fn exchange_code_for_tokens(
     }
 
     let client = hanzo_core::http_client::build_http_client();
-    // Send both code_verifier (PKCE) and publishable_key so the exchange works
-    // with both PKCE-only providers (OpenAI) and confidential-client providers
-    // (Casdoor/hanzo.id).
+    // PKCE-only token exchange (public client, no client_secret)
     let resp = client
         .post(format!("{issuer}/oauth/token"))
         .header("Content-Type", "application/x-www-form-urlencoded")
         .body(format!(
-            "grant_type=authorization_code&code={}&redirect_uri={}&client_id={}&code_verifier={}&client_secret={}",
+            "grant_type=authorization_code&code={}&redirect_uri={}&client_id={}&code_verifier={}",
             urlencoding::encode(code),
             urlencoding::encode(redirect_uri),
             urlencoding::encode(client_id),
             urlencoding::encode(&pkce.code_verifier),
-            urlencoding::encode(hanzo_core::auth::PUBLISHABLE_KEY),
         ))
         .send()
         .await

hanzo-dev/tui/src/chatwidget/gh_actions.rs

@@ -89,7 +89,7 @@ pub(super) fn maybe_watch_after_push(
             .use_rustls_tls()
             .user_agent("dev-cli-rs/github-monitor")
             .build()
-            .unwrap_or_else(|_| reqwest::Client::new());
+            .expect("failed to build reqwest client with rustls");
 
         // Two-phase polling:
         // 1) Appearance window: up to 2 minutes to see a workflow run start