refactor: enforce explicit imports via #![deny(clippy::wildcard_imports)]

Replaced all remaining wildcard imports across the codebase:
- src/ssh.rs:   use russh::*; → explicit {client, ChannelMsg, SshError}
- src/doctor.rs: use crate::{config, ssh}::*; → explicit items
- src/tmux/session.rs: use crate::ssh::*; → explicit items
- src/main.rs:   added #![deny(clippy::wildcard_imports)] crate-level lint
- src/docker/mod.rs: already fixed in previous commit

src/doctor.rs

@@ -1,8 +1,8 @@
 use anyhow::{Context, Result};
 use tracing::info;
 
-use crate::config::*;
-use crate::ssh::*;
+use crate::config::{Cluster, Config, Node, Recipe, load_recipe, resolve_cluster};
+use crate::ssh::{run_ssh, run_ssh_with_retry};
 
 /// Doctor check result for a single node/container.
 pub struct DoctorResult {

src/main.rs

@@ -1,3 +1,5 @@
+#![deny(clippy::wildcard_imports)]
+
 use anyhow::Result;
 use clap::Parser;
 

src/ssh.rs

@@ -1,8 +1,9 @@
 use anyhow::{Context, Result};
 use base64::Engine;
 use base64::engine::general_purpose::STANDARD;
+use russh::client;
 use russh::keys::{PrivateKeyWithHashAlg, load_secret_key as russh_load_secret_key};
-use russh::*;
+use russh::{ChannelMsg, Error as SshError};
 use sha2::{Digest, Sha256};
 use std::sync::Arc;
 use tokio::time::{Duration, sleep};
@@ -150,7 +151,7 @@ pub async fn fetch_host_key(config: &Config, node: &Node) -> Result<String> {
         captured: Arc<Mutex<Option<Vec<u8>>>>,
     }
     impl client::Handler for CaptureHandler {
-        type Error = russh::Error;
+        type Error = SshError;
         async fn check_server_key(
             &mut self,
             key: &russh::keys::PublicKey,
@@ -196,7 +197,7 @@ pub struct VerifyingHandler {
 }
 
 impl client::Handler for VerifyingHandler {
-    type Error = russh::Error;
+    type Error = SshError;
 
     async fn check_server_key(
         &mut self,
@@ -208,7 +209,7 @@ impl client::Handler for VerifyingHandler {
             let hash = Sha256::digest(&key_bytes);
             let fp = format!("SHA256:{}", STANDARD.encode(hash));
             if &fp != expected_fp {
-                return Err(russh::Error::Kex);
+                return Err(SshError::Kex);
             }
         }
         Ok(true)

src/tmux/session.rs

@@ -4,7 +4,7 @@ use tokio::time::sleep;
 use tracing::{info, warn};
 
 use crate::config::{Cluster, Config, Node, Recipe};
-use crate::ssh::*;
+use crate::ssh::{run_ssh, run_ssh_with_retry};
 use crate::tmux::{SessionHealth, TmuxManager};
 
 impl TmuxManager {