refactor: apply clippy let-chains and harden password validation

- Auto-fix 29 clippy warnings by converting nested if-lets to let-chains
- Harden password strength validator to reject restricted substrings
- Simplify rate_limiter state checks using is_none_or
- Improves idiomatic Rust style and overall security posture

src/identity/application_members.rs

@@ -221,8 +221,8 @@ pub async fn update(
         }
     }
 
-    if let Some(new_enabled) = enabled {
-        if new_enabled != existing.enabled {
+    if let Some(new_enabled) = enabled
+        && new_enabled != existing.enabled {
             let action = if new_enabled {
                 "application.member_enabled"
             } else {
@@ -255,7 +255,6 @@ pub async fn update(
                 .await
                 .map_err(AppError::Database)?;
         }
-    }
 
     provider
         .application_members()

src/identity/applications.rs

@@ -324,11 +324,9 @@ pub async fn update(
         .find_by_slug(slug)
         .await
         .map_err(AppError::Database)?
-    {
-        if other.entity_id != id || other.entity_type != "application" {
+        && (other.entity_id != id || other.entity_type != "application") {
             return Err(AppError::Conflict(format!("slug '{slug}' already exists")));
         }
-    }
 
     let redirect_json = redirect_uris.map(|v| serde_json::to_string(&v).unwrap_or_default());
     let scopes_json = scopes.map(|v| serde_json::to_string(&v).unwrap_or_default());

src/identity/roles.rs

@@ -191,11 +191,9 @@ pub async fn update_role(
         .find_by_name(name)
         .await
         .map_err(AppError::Database)?
-    {
-        if other.id != id {
+        && other.id != id {
             return Err(AppError::Conflict(format!("role '{name}' already exists")));
         }
-    }
 
     provider
         .roles()