fix(tls/review-tls): add feature gates to for_quinn tests, run cargo fmt

Phase 1 review checkpoint fixes:
- Added #[cfg(feature = "quinn")] to build_quinn_server_config_from_rustls
  and build_quinn_client_config_* tests (for_quinn is feature-gated)
- Ran cargo fmt for consistent formatting
- All 34 tests pass across all feature combos (default, no-default, all-features)
- Workspace fully green: cargo test --workspace, cargo clippy, cargo fmt

crates/alknet-tls/src/client.rs

@@ -20,10 +20,7 @@ impl TlsClientConfig {
     /// Build a client config from `ConnectionCredentials` and an ALPN.
     /// Selects the server cert verifier by `remote_identity` presence
     /// (ADR-034 §3): `Some` → fingerprint pin, `None` → CA verification.
-    pub fn new(
+    pub fn new(credentials: &ConnectionCredentials, alpn: &[u8]) -> Result<Self, TlsError> {
-        credentials: &ConnectionCredentials,
-        alpn: &[u8],
-    ) -> Result<Self, TlsError> {
         let provider = Arc::new(rustls::crypto::aws_lc_rs::default_provider());
 
         let client_auth = build_client_auth(&provider, &credentials.tls_identity)?;
@@ -38,7 +35,9 @@ impl TlsClientConfig {
         config.alpn_protocols = vec![alpn.to_vec()];
         config.enable_early_data = true;
 
-        Ok(Self { rustls_config: config })
+        Ok(Self {
+            rustls_config: config,
+        })
     }
 
     /// Convert to a `quinn::ClientConfig` for QUIC transport.
@@ -63,9 +62,7 @@ fn build_client_auth(
 ) -> Result<Arc<dyn rustls::client::ResolvesClientCert>, TlsError> {
     match tls_identity {
         Some(TlsIdentity::RawKey(secret_key)) => {
-            let signing_key = Arc::new(crate::signing::Ed25519SigningKey::new(
+            let signing_key = Arc::new(crate::signing::Ed25519SigningKey::new(secret_key.clone()));
-                secret_key.clone(),
-            ));
             let spki = signing_key.spki_public_key();
             let cert = rustls::pki_types::CertificateDer::from(spki.to_vec());
             let certified_key = Arc::new(rustls::sign::CertifiedKey::new(vec![cert], signing_key));
@@ -74,9 +71,8 @@ fn build_client_auth(
         Some(TlsIdentity::X509 { cert, key }) => {
             let cert_chain = crate::pem::load_cert_chain(cert)?;
             let key_der = crate::pem::load_private_key(key)?;
-            let certified_key =
+            let certified_key = rustls::sign::CertifiedKey::from_der(cert_chain, key_der, provider)
-                rustls::sign::CertifiedKey::from_der(cert_chain, key_der, provider)
+                .map_err(|e| TlsError::Config(e.to_string()))?;
-                    .map_err(|e| TlsError::Config(e.to_string()))?;
             Ok(Arc::new(RawKeyClientCertResolver::new(Arc::new(
                 certified_key,
             ))))
@@ -489,6 +485,7 @@ mod tests {
         );
     }
 
+    #[cfg(feature = "quinn")]
     #[test]
     fn build_quinn_client_config_with_raw_key_identity_builds_without_error() {
         let sk = Ed25519SecretKey::generate();
@@ -503,11 +500,11 @@ mod tests {
         let _ = quinn_config;
     }
 
+    #[cfg(feature = "quinn")]
     #[test]
     fn build_quinn_client_config_with_no_remote_identity_builds_without_error() {
         let sk = Ed25519SecretKey::generate();
-        let credentials =
+        let credentials = ConnectionCredentials::new().with_tls_identity(TlsIdentity::RawKey(sk));
-            ConnectionCredentials::new().with_tls_identity(TlsIdentity::RawKey(sk));
         let config = TlsClientConfig::new(&credentials, b"alknet/call")
             .expect("TlsClientConfig::new must build for CA-verification path");
         let quinn_config = config.for_quinn().expect("for_quinn must convert");

crates/alknet-tls/src/server.rs

@@ -3,9 +3,9 @@
 
 use std::sync::Arc;
 
-use alknet_core::config::{Ed25519SecretKey, TlsIdentity};
 #[cfg(feature = "acme")]
 use alknet_core::config::AcmeDirectory;
+use alknet_core::config::{Ed25519SecretKey, TlsIdentity};
 #[cfg(feature = "acme")]
 use tracing::{debug, error, warn};
 
@@ -24,10 +24,7 @@ pub struct TlsServerConfig {
 impl TlsServerConfig {
     /// Build a server config from a `TlsIdentity` and ALPN list.
     /// ACME identities spawn a background cert-renewal task.
-    pub async fn new(
+    pub async fn new(tls_identity: &TlsIdentity, alpns: &[Vec<u8>]) -> Result<Self, TlsError> {
-        tls_identity: &TlsIdentity,
-        alpns: &[Vec<u8>],
-    ) -> Result<Self, TlsError> {
         match tls_identity {
             TlsIdentity::Acme {
                 domains,
@@ -209,8 +206,7 @@ struct SelfSignedCert {
 
 fn generate_self_signed_cert() -> Result<SelfSignedCert, TlsError> {
     use rcgen::{CertificateParams, KeyPair};
-    let key_pair =
+    let key_pair = KeyPair::generate().map_err(|e| TlsError::Config(e.to_string()))?;
-        KeyPair::generate().map_err(|e| TlsError::Config(e.to_string()))?;
     let params = CertificateParams::default();
     let cert = params
         .self_signed(&key_pair)
@@ -436,6 +432,7 @@ mod tests {
         let _ = build_rustls_server_config(&identity, &[]);
     }
 
+    #[cfg(feature = "quinn")]
     #[test]
     fn build_quinn_server_config_from_rustls_succeeds() {
         let sk = Ed25519SecretKey::generate();