Improve coverage, fix CLI KOReader passwords, and harden fork CI

[canardleteer]

Summary

• Raise library test coverage above 80% by extracting CLI helpers from main, adding error/serialization unit tests, and covering graceful server shutdown (#17)
• Fix CLI user create / user reset-password so the password is MD5-hashed the same way KOReader’s sync client does, then stored with Argon2 (CLI-created users with a plain password could not authenticate from KOReader)
• Make init_logging idempotent via try_init so run_server can be invoked more than once in-process (e.g. tests)
• Bump Rust deps and GitHub Actions from open Renovate updates (#5):
  • Crates: #119 uuid, #120 serial_test, #121 chrono, #123 tower-http, #126 rkyv, #127 clap, #128 tokio
  • Actions: #122 codecov-action v7, #124 checkout v7, #125 cache v6
• Gate release-plz, CD asset uploads, and Docker Hub publish on github.repository == 'szaffarano/korrosync' so forks do not publish
• Add rust-toolchain.toml pinning stable with rustfmt, clippy, rust-src, rust-analyzer, and llvm-tools-preview

Test plan

• CI green on this PR (test / fmt / clippy / machete / coverage)
• On a fork: confirm release-plz, CD, and Docker publish jobs are skipped
• cargo test and cargo clippy -- -D warnings locally
• cargo machete reports no unused dependencies
• rustup show / rustc --version pick up the repo rust-toolchain.toml
• CLI: user create -u alice -p secret, then authenticate from KOReader (or with x-auth-key = MD5 of secret)
• Existing plaintext CLI users need user reset-password once after this change