fix(backend): refresh-token jti + code cleanup (#15,#28,#29,#30)

Refresh-token rotation bug (found via Solaria smoke test):
* RefreshClaims now carries a unique random jti (UUID v4). Without it, two
  refresh tokens issued in the same second (e.g. on rotation) were byte-identical
  — breaking rotation, colliding on the tokenHash unique index, and making a
  stolen old token indistinguishable from the new one. Every refresh token is
  now unique regardless of issue time. Added a unit test asserting consecutive
  tokens differ.

Code cleanup (review items):
* #15: removed unused deps tower_governor, slog, thiserror (zero refs in src/).
* #30: deleted leftover src/main.rs.restore (a stale git-error-message backup).
* #28: removed the 9 single-line-comment stub files under src/db/ (appointment,
  family, health_data, lab_result, medication, profile, permission, share, user)
  and their mod declarations; nothing referenced them, real logic lives in
  mongodb_impl.rs/init.rs.
* #29: stripped 61 broad module-level #![allow(...)] suppressions across src/.
  Fixed the surfaced warnings instead: 4 unused 'claims' extractor bindings ->
  _claims; removed dead OpenFDAService.client/base_url fields + the never-called
  query_drug_events method + unused HashMap/reqwest imports; applied clippy's
  mechanical fixes (Ok(?) -> ?, Copy ObjectId clone, redundant closures,
  useless conversions); rewrote 'if let Ok(_) = x' -> 'if x.is_ok()'. Result:
  cargo build + clippy --all-targets are warning-free with no blanket allows.

Verified: fmt clean, build clean, clippy 0 warnings, 19 unit tests pass
(was 18; +1 jti-uniqueness test).

backend/src/middleware/client_ip.rs

@@ -8,7 +8,6 @@
 //! 3. The peer address from Axum's `ConnectInfo<SocketAddr>` (direct connection).
 //! 4. `"0.0.0.0"` only if none of the above are present.
 
-#![allow(dead_code)]
 use axum::{
     extract::ConnectInfo, extract::Request, http::HeaderMap, middleware::Next, response::Response,
 };