refactor: cut what a whole-repo audit proved dead, padded, or hand-rolled

Seven region audits, every finding adversarially verified against the
whole workspace before being applied; 80 landed and the two that failed
in application were refuted honestly (ParseError has a from_str_radix
producer the audit missed; NatPmpError's Display is the only reader of
its diagnostic payloads).

The bigger cuts:

- The NewPeer/PierceFireWall cluster: an operation variant nothing ever
  sent, its 77-line arm, a protocol-wrong Client::pierce_firewall that
  wrote a peer-init frame down the server socket, and the struct only
  they used. The live paths in peer/listen.rs are untouched.
- The ops loop reads `for operation in reader` instead of hand-rolling
  recv/break, de-indenting the whole dispatch body.
- Dead lib surface: Message::print_hex and four unused accessors,
  UploadFailed, registry and actor getters, build_watch_user,
  strip_ansi_codes, delegating shims on ClientContext. Removing public
  items makes this a semver major, which the release pipeline enforces.
- Never-used flexibility: the state-migration framework that never held
  a migration, border-type helpers that all answered Rounded, the TUI's
  max_concurrent_downloads field nothing read.
- Convergence: six poll loops into poll_until, three wrap-around
  navigation blocks into cycle, hit tests into Rect::contains, char
  walkers into floor/ceil_char_boundary, five Download literals into
  one helper, the suites' shared scaffolding into tests/common.

Deliberately not taken: swapping the hand-rolled zlib inflate and MD5
for crates (they replace wire-facing machinery whose tolerance of
real-world peer quirks no local test exercises) and pulling chrono into
the lib for a log timestamp. Recorded for their own decision.

Net -1002 lines. Both e2e modes stay green: 94 CLI tests each way, 16
protocol, 33 lib, unit suites, clippy pedantic clean, aislop 100/100
with the four scanner false positives suppressed inline where they
fire.

soulseek-rs/tests/common/mod.rs

@@ -0,0 +1,46 @@
+//! Scaffolding both CLI end-to-end binaries need: the environment they scrub,
+//! the soulfind they run against, and a port nobody else holds.
+
+#![allow(dead_code)]
+
+use std::path::{Path, PathBuf};
+
+/// Every environment variable the binary reads, cleared for each run so a
+/// developer's shell (or a stray `.env`) cannot change what a test observes —
+/// and so no run finds a real daemon.
+pub const CLI_ENV_VARS: [&str; 15] = [
+    "SOULSEEK_CONFIG_DIR",
+    "SOULSEEK_STATE_DIR",
+    "SOULSEEK_DAEMON",
+    "SOULSEEK_DAEMON_TOKEN",
+    "SOULSEEK_USERNAME",
+    "SOULSEEK_PASSWORD",
+    "SOULSEEK_PASSWORD_CMD",
+    "SOULSEEK_SERVER",
+    "SOULSEEK_NO_LISTENER",
+    "SOULSEEK_LISTENER_PORT",
+    "SOULSEEK_DOWNLOAD_DIR",
+    "SOULSEEK_SHARED_DIR",
+    "SOULSEEK_MAX_CONCURRENT_DOWNLOADS",
+    "SOULSEEK_SEARCH_TIMEOUT",
+    "SOULSEEK_CONFIG",
+];
+
+pub fn soulfind_binary() -> Option<PathBuf> {
+    if let Ok(path) = std::env::var("SOULFIND_BIN") {
+        let path = PathBuf::from(path);
+        return path.exists().then_some(path);
+    }
+    Path::new(env!("CARGO_MANIFEST_DIR"))
+        .ancestors()
+        .map(|dir| dir.join("soulfind/bin/soulfind"))
+        .find(|candidate| candidate.exists())
+}
+
+pub fn free_port() -> Option<u16> {
+    std::net::TcpListener::bind("127.0.0.1:0")
+        .ok()?
+        .local_addr()
+        .ok()
+        .map(|addr| addr.port())
+}