ci fixes: cargo fmt, eslint entities, max-lines split

CI on 6ffbe97 failed on two auto-fixable gates. Both fixed:

  * cargo fmt --all — rustfmt applied across the surface touched
    by the last ~20 commits (world.rs, security_scan.rs,
    routes/{missions,nodes,terminal}.rs, fleet_herdr.rs,
    mission_workspace.rs, benchmark_runner.rs, mission_refiner.rs,
    lib.rs, tests/mission_orchestrator.rs, cm-db/repo/{missions,teams}.rs,
    bins/clawmates-node/src/main.rs)
  * eslint apostrophe escapes in HerdrSessions + MissionWizard
  * eslint max-lines: extracted EditMissionModal + RefineDiffModal
    (each ~200 LoC) into their own files. MissionCanvas drops from
    1424 to 1026, comfortably under both the 1250 eslint cap and the
    1500 CI budget.

New files:
  frontend/src/components/dashboard/EditMissionModal.tsx  (211 LoC)
  frontend/src/components/dashboard/RefineDiffModal.tsx   (208 LoC)

Verified locally: cargo fmt --check clean, cargo check clean,
mission_orchestrator test 3/3 pass, tsc + eslint --quiet both silent.

crates/bins/clawmates-node/src/main.rs

@@ -509,10 +509,7 @@ async fn handle_frame(
         // polls that pane's agent_status; `herdr_read` scrapes its recent
         // transcript. Node just shells out to the `herdr` binary — the
         // Herdr background daemon is expected to already be running.
-        op @ ("herdr_dispatch"
-        | "herdr_status"
-        | "herdr_read"
-        | "herdr_workspaces"
+        op @ ("herdr_dispatch" | "herdr_status" | "herdr_read" | "herdr_workspaces"
         | "herdr_snapshot") => {
             if let Some(id) = v.get("id").and_then(Value::as_u64) {
                 let (ok, output) = herdr_op(op, &v).await;
@@ -675,11 +672,16 @@ fn spawn_container_pty(
 /// specific agent container on this node.
 pub(crate) enum PtyTarget {
     Host,
-    Container { container: String, session: String },
+    Container {
+        container: String,
+        session: String,
+    },
     /// Custom argv (Herdr Live Pane uses this to spawn `herdr` directly
     /// so the browser xterm attaches straight into the node's Herdr TUI
     /// instead of a login shell).
-    Command { argv: Vec<String> },
+    Command {
+        argv: Vec<String>,
+    },
 }
 
 impl PtyTarget {
@@ -1008,13 +1010,7 @@ async fn herdr_op(op: &str, v: &Value) -> (bool, String) {
                 let escaped = prompt.replace('\'', "'\\''");
                 format!("{cli} '{escaped}'")
             };
-            let (rok, rout) = run(vec![
-                "pane".into(),
-                "run".into(),
-                pane_id.clone(),
-                launch,
-            ])
-            .await;
+            let (rok, rout) = run(vec!["pane".into(), "run".into(), pane_id.clone(), launch]).await;
             let payload = serde_json::json!({
                 "pane_id": pane_id,
                 "split": split_out,