refactor(tests): migrate remaining batches to tests/common/

Finishes the lift of shared helpers into `tests/common/`. Covered:
- health, web, oneliners_api, upload (31 tests; upload exercises the
  new `multipart_upload_body` helper driven by doctate_common field
  constants)
- sse_integration, sse_cleanup, transcribe, oneliner_heal_decoupled,
  silent_case_empty, failed_only_case_empty_oneliner,
  transient_failure_retries (24 tests)

Also applied cargo fmt across the test tree and fixed one clippy
needless_borrows_for_generic_args warning in analyze_test.

All 387 tests pass; 3 ignored (as before).

Side effect: health_test previously used a hardcoded `/tmp/doctate-test`
data path, which parallel `cargo test` runs could collide on. The
migration replaces it with the common unique-tmpdir pattern, removing
a latent flake.

server/tests/security_headers_test.rs

@@ -26,14 +26,9 @@ fn count_header_values(resp: &Response, name: &str) -> usize {
 }
 
 async fn get(app: axum::Router, uri: &str) -> Response {
-    app.oneshot(
-        Request::builder()
-            .uri(uri)
-            .body(Body::empty())
-            .unwrap(),
-    )
-    .await
-    .unwrap()
+    app.oneshot(Request::builder().uri(uri).body(Body::empty()).unwrap())
+        .await
+        .unwrap()
 }
 
 // ---------- presence tests ----------
@@ -42,10 +37,7 @@ async fn get(app: axum::Router, uri: &str) -> Response {
 async fn api_health_has_all_security_headers() {
     let resp = get(test_app(), "/api/health").await;
     assert_eq!(resp.status(), StatusCode::OK);
-    assert_eq!(
-        header_opt(&resp, "x-content-type-options"),
-        Some("nosniff")
-    );
+    assert_eq!(header_opt(&resp, "x-content-type-options"), Some("nosniff"));
     assert_eq!(header_opt(&resp, "x-frame-options"), Some("DENY"));
     assert_eq!(header_opt(&resp, "referrer-policy"), Some("no-referrer"));
     assert!(
@@ -123,10 +115,7 @@ async fn csp_blocks_form_action_hijack() {
 #[tokio::test]
 async fn nosniff_blocks_mime_confusion() {
     let resp = get(test_app(), "/api/health").await;
-    assert_eq!(
-        header_opt(&resp, "x-content-type-options"),
-        Some("nosniff")
-    );
+    assert_eq!(header_opt(&resp, "x-content-type-options"), Some("nosniff"));
 }
 
 /// Session-carrying URLs should not leak to third parties via `Referer`.
@@ -162,10 +151,7 @@ async fn error_redirect_still_carries_security_headers() {
     // session extractor).
     let resp = get(test_app(), "/web/cases").await;
     assert_eq!(resp.status(), StatusCode::FOUND);
-    assert_eq!(
-        header_opt(&resp, "x-content-type-options"),
-        Some("nosniff")
-    );
+    assert_eq!(header_opt(&resp, "x-content-type-options"), Some("nosniff"));
     assert_eq!(header_opt(&resp, "x-frame-options"), Some("DENY"));
     assert!(header_opt(&resp, "content-security-policy").is_some());
 }