build(rust): pin the toolchain to 1.97.1 for dev and CI

The Rust toolchain was unpinned on both sides, and the two sides had drifted
five releases apart: the CI builder image ships rustc 1.97.1, the development
machine was on 1.92.0. Clippy's lint set and rustfmt's output both change
between releases, so a green `cargo clippy` / `cargo fmt --check` locally said
nothing about CI and vice versa — which is the reason the clippy gate could
not be trusted enough to turn on.

src-tauri/rust-toolchain.toml pins channel 1.97.1 with the rustfmt and clippy
components. Deliberately no `targets` list: that would make rustup fetch the
Android and Windows std libraries on every plain `cargo test`, including on
machines that never cross-compile. The image already has them.

Dockerfile.builder installs that exact version instead of "latest stable at
rebuild time", and prints rustc/clippy versions so a mismatch is visible in
the build log.

The pin only becomes authoritative once the image is rebuilt and pushed
(scripts/build-builder-image.sh). Until then CI still runs whatever rustc the
current image has, and if that is not 1.97.1 rustup will download the pinned
toolchain at job time — a toolchain install in CI, which CLAUDE.md forbids.
Both files carry that warning next to the version.

Note: the clippy step in .gitea/workflows/build-and-test.yml is left advisory
here; tightening it wants a warning count measured on 1.97.1 first.

src-tauri/rust-toolchain.toml

@@ -0,0 +1,26 @@
+# Pinned Rust toolchain for the JellyTau backend.
+#
+# TRACES: | DR-206
+#
+# Why pin: the toolchain was unpinned, so the CI builder image (rustc 1.97.1)
+# and developer machines (as low as 1.92.0) were five releases apart. Clippy's
+# lint set and rustfmt's output both move between releases, which means a green
+# `cargo clippy` / `cargo fmt --check` locally proved nothing about CI — and vice
+# versa. Everything in this file exists to make both sides run the same compiler.
+#
+# 🔴 This value MUST match the rustc that Dockerfile.builder installs (see
+# RUST_VERSION there). If they drift, rustup downloads the pinned toolchain at
+# job time inside the container — a toolchain install in CI, which is exactly
+# what CLAUDE.md's "CI installs no system tools" rule forbids. To move the pin:
+# bump BOTH this file and Dockerfile.builder, then rebuild and push the image
+# with scripts/build-builder-image.sh before merging.
+#
+# No `targets` key on purpose: listing the Android/Windows targets here would
+# make rustup fetch all of them on every plain `cargo test`, including on
+# machines that never cross-compile. The builder image already carries them
+# (`rustup target add` in Dockerfile.builder), and the cross-build scripts add
+# them locally when needed.
+
+[toolchain]
+channel = "1.97.1"
+components = ["rustfmt", "clippy"]