refactor: cut what a whole-repo audit proved dead, padded, or hand-rolled

Seven region audits, every finding adversarially verified against the
whole workspace before being applied; 80 landed and the two that failed
in application were refuted honestly (ParseError has a from_str_radix
producer the audit missed; NatPmpError's Display is the only reader of
its diagnostic payloads).

The bigger cuts:

- The NewPeer/PierceFireWall cluster: an operation variant nothing ever
  sent, its 77-line arm, a protocol-wrong Client::pierce_firewall that
  wrote a peer-init frame down the server socket, and the struct only
  they used. The live paths in peer/listen.rs are untouched.
- The ops loop reads `for operation in reader` instead of hand-rolling
  recv/break, de-indenting the whole dispatch body.
- Dead lib surface: Message::print_hex and four unused accessors,
  UploadFailed, registry and actor getters, build_watch_user,
  strip_ansi_codes, delegating shims on ClientContext. Removing public
  items makes this a semver major, which the release pipeline enforces.
- Never-used flexibility: the state-migration framework that never held
  a migration, border-type helpers that all answered Rounded, the TUI's
  max_concurrent_downloads field nothing read.
- Convergence: six poll loops into poll_until, three wrap-around
  navigation blocks into cycle, hit tests into Rect::contains, char
  walkers into floor/ceil_char_boundary, five Download literals into
  one helper, the suites' shared scaffolding into tests/common.

Deliberately not taken: swapping the hand-rolled zlib inflate and MD5
for crates (they replace wire-facing machinery whose tolerance of
real-world peer quirks no local test exercises) and pulling chrono into
the lib for a log timestamp. Recorded for their own decision.

Net -1002 lines. Both e2e modes stay green: 94 CLI tests each way, 16
protocol, 33 lib, unit suites, clippy pedantic clean, aislop 100/100
with the four scanner false positives suppressed inline where they
fire.

soulseek-rs/src/daemon/mod.rs

@@ -332,48 +332,42 @@ const fn raise_open_file_limit() -> std::io::Result<u64> {
 /// afterwards is a poor first experience. stdout stays empty either way, so
 /// `daemon` still composes in a pipeline.
 fn ready(ctx: &Ctx, bind: Option<&str>, token: &str) {
-    ctx.out.status("");
-    ctx.out.status("ready — leave this running.");
-    ctx.out.status("");
-    ctx.out
-        .status("  On this machine, nothing else to do. Other commands find");
-    ctx.out
-        .status("  it on their own and share this one login:");
-    ctx.out.status("");
-    ctx.out.status("      soulseek-rs search 'aphex twin'");
-    ctx.out
-        .status("      soulseek-rs                       (the TUI attaches)");
-    ctx.out.status("      soulseek-rs daemon status");
-    ctx.out.status("      soulseek-rs daemon stop");
-    ctx.out.status("");
+    const BANNER: &str = "
+ready — leave this running.
+
+  On this machine, nothing else to do. Other commands find
+  it on their own and share this one login:
+
+      soulseek-rs search 'aphex twin'
+      soulseek-rs                       (the TUI attaches)
+      soulseek-rs daemon status
+      soulseek-rs daemon stop
+";
+    const LOCAL_ONLY: &str =
+        "  To drive it from another machine, restart with --bind ADDR;
+  `soulseek-rs daemon token` prints the secret it needs.
+";
+
+    ctx.out.status(BANNER);
 
     let Some(address) = bind else {
-        ctx.out.status(
-            "  To drive it from another machine, restart with --bind ADDR;",
-        );
-        ctx.out
-            .status("  `soulseek-rs daemon token` prints the secret it needs.");
-        ctx.out.status("");
+        ctx.out.status(LOCAL_ONLY);
         return;
     };
 
     ctx.out.status(&format!(
-        "  From another machine, point a client at {address} with"
+        "  From another machine, point a client at {address} with
+  this token:
+
+      {token}
+
+      soulseek-rs config set daemon <this-host>:PORT
+      soulseek-rs config set daemon_token <token above>
+
+  That port has no encryption. Keep it off the open internet and \
+         reach it over SSH instead.
+"
     ));
-    ctx.out.status("  this token:");
-    ctx.out.status("");
-    ctx.out.status(&format!("      {token}"));
-    ctx.out.status("");
-    ctx.out
-        .status("      soulseek-rs config set daemon <this-host>:PORT");
-    ctx.out
-        .status("      soulseek-rs config set daemon_token <token above>");
-    ctx.out.status("");
-    ctx.out.status(
-        "  That port has no encryption. Keep it off the open internet and \
-         reach it over SSH instead.",
-    );
-    ctx.out.status("");
 }
 
 /// Remove the socket file so the next start does not have to reason about