ci: 修复 e2e 演示脚本数据面 token 化遗漏 + 新 clippy result-large-err lint

e2e job（g1 / gray 在 CI bash -e 下暴露）：
- g1-policy-demo.sh §3/§4：共享引用改用 shared-ref-rework 后模型
  （旧 group 字段 + POST /shared/refs 端点已移除→ 恒 404/422，本地无 -e 时静默假过）；
  现为：扁平共享项 + 结构 shared:true 标记 + 分支 shared_bindings + 绑定发布，
  并补「manual materialize」断言（下次分支发布读到新共享值 60）；
- gray-demo.sh：snapshot/watch 数据面端点需数据面 token（管理会话不适用），
  从启动日志提取 dev token（DP_AUTH）注入 5 处数据面调用；
- dev-single-demo.sh watch 段同源问题已于上提交修复，本地 3/3 稳定。

lint job：CI stable clippy（1.98 新增 result-large-err）命中 dsh-raft http_network
RPCError 返回类型（体积由 openraft trait 契约固定）→ 显式豁免（装箱改签名波及调用点，
风险高于 lint 门禁）。

本地验证：fmt/clippy(0 errors)/deny/contract 全过；cargo test 35 套件 0 失败；
g1/gray/gray-obs/cluster/seed/chaos/dev-single-demo/api-surface 全部通过。

Author: ipconfiger

scripts/g1-policy-demo.sh

@@ -39,16 +39,28 @@ assert r.get('warnings'), 'warn 模式应带 warnings: %s' % r
 " && echo "  warn 放行 + warnings 明细 OK"
 
 echo "== 3. --shared-cascade manual：共享发布不级联引用分支 =="
-J -X POST $BASE/api/v1/shared -d '{"group":"lib","key":"timeout","type":"int","value":{"type":"int","int_value":30}}' >/dev/null
+# 共享引用（shared-ref-rework 后模型）：结构 shared 标记 + 分支 shared_bindings（旧 group/refs 端点已移除）
+J -X POST $BASE/api/v1/shared -d '{"key":"timeout","type":"int","description":"全局超时","value":{"type":"int","int_value":30}}' >/dev/null
 J -X POST $BASE/api/v1/shared/publish -d '{"comment":"v1","request_id":"sp1"}' >/dev/null
-J -X POST $BASE/api/v1/shared/refs -d '{"project":"g1","group":"redis","item_key":"port","shared_group":"lib","shared_key":"timeout"}' >/dev/null
+J -X PUT $BASE/api/v1/projects/g1/structure-draft -d '{"base_version":2,"groups":[{"name":"redis","items":[{"key":"host","type":"string","required":true},{"key":"port","type":"int","shared":true}]}]}' >/dev/null
+J -X POST $BASE/api/v1/projects/g1/structure-draft/publish -d '{"comment":"shared ref","request_id":"sr1"}' >/dev/null
+J -X PUT $BASE/api/v1/projects/g1/branches/dev/draft -d '{"updates":[{"group":"redis","key":"host","value":{"type":"string","str_value":"10.0.0.1"}}],"shared_bindings":[{"group":"redis","key":"port","shared_key":"timeout"}]}' >/dev/null
+J -X POST $BASE/api/v1/projects/g1/branches/dev/publish -d '{"comment":"bind","request_id":"pb1"}' >/dev/null
 BEFORE=$(J $BASE/api/v1/projects/g1/branches/dev | python3 -c "import json,sys; print(json.load(sys.stdin)['active_version'])")
-J -X POST $BASE/api/v1/shared -d '{"group":"lib","key":"timeout","type":"int","value":{"type":"int","int_value":60}}' >/dev/null
+J -X POST $BASE/api/v1/shared -d '{"key":"timeout","type":"int","description":"全局超时","value":{"type":"int","int_value":60}}' >/dev/null
 J -X POST $BASE/api/v1/shared/publish -d '{"comment":"v2","request_id":"sp2"}' >/dev/null
 AFTER=$(J $BASE/api/v1/projects/g1/branches/dev | python3 -c "import json,sys; print(json.load(sys.stdin)['active_version'])")
 [ "$BEFORE" = "$AFTER" ] && echo "  manual: shared publish does NOT cascade (branch stays v$AFTER) OK" || { echo "  FAIL: branch was cascaded"; exit 1; }
 
 echo "== 4. manual materialize: next publish reads new shared value 60 =="
+# 共享发布不自动级联，但分支下次显式发布会物化新共享值
+J -X PUT $BASE/api/v1/projects/g1/branches/dev/draft -d '{"updates":[{"group":"redis","key":"host","value":{"type":"string","str_value":"10.0.0.2"}}]}' >/dev/null
+J -X POST $BASE/api/v1/projects/g1/branches/dev/publish -d '{"comment":"next","request_id":"pb2"}' >/dev/null
+curl -sf -H "$AUTH" "$BASE/v1/projects/g1/branches/dev/config?format=json" | python3 -c "
+import json,sys
+d=json.load(sys.stdin)
+assert d['redis']['port']==60, d['redis']
+" && echo "  manual materialize OK（下次发布读到 port=60）"
 echo "== 5. --read-mode linear：读正常（dev-single 恒满足）=="
 curl -sf $BASE/v1/projects/g1/branches/dev/snapshot >/dev/null && echo "  linear 读 OK"
 J "$BASE/api/v1/projects/g1/diff?branch_a=dev&branch_b=test" >/dev/null && echo "  diff 读 OK"

scripts/gray-demo.sh

@@ -19,6 +19,10 @@ done
 curl -sf $BASE/healthz >/dev/null && echo "  healthz OK" || { echo "  healthz FAIL"; cat /tmp/dsh-gray.log; exit 1; }
 TOKEN=$(curl -sf -X POST $BASE/api/v1/login -H 'Content-Type: application/json' -d '{"password":"admin123"}' | python3 -c "import json,sys; print(json.load(sys.stdin)['token'])")
 AUTH="Authorization: Bearer $TOKEN"
+# 数据面端点（/v1/...，含 snapshot/watch）需数据面 token（数据面 token 化后，管理会话不适用）
+DEV_TOKEN=$(sed -n 's/.*开发数据面 token = \([a-f0-9]*\).*/\1/p' /tmp/dsh-gray.log)
+[ -n "$DEV_TOKEN" ] || { echo "  dev token 未打印"; cat /tmp/dsh-gray.log; exit 1; }
+DP_AUTH="Authorization: Bearer $DEV_TOKEN"
 echo "  admin login ok"
 
 echo "== 1. 创建项目 + 结构（redis.host 必填）=="
@@ -49,27 +53,27 @@ curl -sf -H "$AUTH" $BASE/api/v1/projects/order-service/branches/dev/gray-status
 
 echo "== 4. 数据面三路解析（HTTP snapshot 带身份头）=="
 echo "--- 华北（X-Dsh-Labels: zone=cn-north-1）→ 应返回 gray-host + gray=true:"
-curl -sf $BASE/v1/projects/order-service/branches/dev/snapshot \
+curl -sf -H "$DP_AUTH" $BASE/v1/projects/order-service/branches/dev/snapshot \
   -H 'X-Dsh-Instance: web-1' -H 'X-Dsh-Labels: zone=cn-north-1,svc=checkout' | tee /tmp/gray-north.json
 echo
 grep -q '"gray-host"' /tmp/gray-north.json && grep -q '"gray":true' /tmp/gray-north.json \
   && echo "  华北命中灰度 ✅" || { echo "  FAIL: 华北应读灰度"; exit 1; }
 
 echo "--- 华南（zone=cn-south-1）→ 应返回 stable-host + gray=false:"
-curl -sf $BASE/v1/projects/order-service/branches/dev/snapshot \
+curl -sf -H "$DP_AUTH" $BASE/v1/projects/order-service/branches/dev/snapshot \
   -H 'X-Dsh-Instance: web-2' -H 'X-Dsh-Labels: zone=cn-south-1' | tee /tmp/gray-south.json
 echo
 grep -q '"stable-host"' /tmp/gray-south.json && grep -q '"gray":false' /tmp/gray-south.json \
   && echo "  华南未命中 ✅" || { echo "  FAIL: 华南应读稳定"; exit 1; }
 
 echo "--- 无身份（旧客户端）→ 应返回 stable-host + gray=false（Q2）:"
-curl -sf $BASE/v1/projects/order-service/branches/dev/snapshot | tee /tmp/gray-noid.json
+curl -sf -H "$DP_AUTH" $BASE/v1/projects/order-service/branches/dev/snapshot | tee /tmp/gray-noid.json
 echo
 grep -q '"stable-host"' /tmp/gray-noid.json && grep -q '"gray":false' /tmp/gray-noid.json \
   && echo "  无身份不进灰度 ✅" || { echo "  FAIL: 无身份应读稳定"; exit 1; }
 
 echo "== 5. watch：灰度转正补发事件（gray=true，version ≤ 客户端 last 仍投递，Q4）=="
-curl -sN $BASE/v1/projects/order-service/branches/dev/watch >/tmp/gray-watch.out 2>/dev/null &
+curl -sN -H "$DP_AUTH" $BASE/v1/projects/order-service/branches/dev/watch >/tmp/gray-watch.out 2>/dev/null &
 WPID=$!
 sleep 0.5
 curl -sf -H "$AUTH" -X POST $BASE/api/v1/projects/order-service/branches/dev/gray-promote -H 'Content-Type: application/json' -d '{"comment":"全量","request_id":"pr-1"}' >/dev/null
@@ -80,7 +84,7 @@ grep -q '"gray":true' /tmp/gray-watch.out && echo "  promote 补发事件 gray=t
 
 echo "== 6. 转正后全量客户端读新稳定版（gray=false）=="
 curl -sf -H "$AUTH" $BASE/api/v1/projects/order-service/branches/dev/gray-status | python3 -m json.tool
-curl -sf $BASE/v1/projects/order-service/branches/dev/snapshot -H 'X-Dsh-Instance: web-1' -H 'X-Dsh-Labels: zone=cn-north-1' | tee /tmp/gray-promoted.json
+curl -sf -H "$DP_AUTH" $BASE/v1/projects/order-service/branches/dev/snapshot -H 'X-Dsh-Instance: web-1' -H 'X-Dsh-Labels: zone=cn-north-1' | tee /tmp/gray-promoted.json
 echo
 grep -q '"gray-host"' /tmp/gray-promoted.json && grep -q '"gray":false' /tmp/gray-promoted.json \
   && echo "  转正后全量读到 gray-host（灰度内容成为稳定版）✅" || { echo "  FAIL"; exit 1; }

server/crates/dsh-raft/src/http_network.rs

@@ -27,6 +27,9 @@ pub struct HttpNetwork {
 }
 
 impl HttpNetwork {
+    // 返回类型 RPCError<NodeId, NodeInfo, …> 由 openraft RaftNetwork trait 契约固定（体积大）；
+    // 装箱会改签名/波及调用点，显式豁免 result-large-err（CI stable clippy 1.98 新增 lint）。
+    #[allow(clippy::result_large_err)]
     async fn post<T: serde::Serialize, R: DeserializeOwned>(
         &self,
         path: &str,
@@ -55,6 +58,8 @@ impl HttpNetwork {
 /// 占位错误类型（RPCError 的 E 参数；实际错误以 Network 变体返回）。
 pub type RaftErrorPlaceholder = openraft::error::RaftError<NodeId>;
 
+// result-large-err：RPCError 体积由 openraft trait 契约决定，豁免（同上）。
+#[allow(clippy::result_large_err)]
 impl RaftNetwork<TypeConfig> for HttpNetwork {
     async fn append_entries(
         &mut self,