feat(drive,lib,docs): add global settings for the Drive lease (#1677)

[newhoggy]

Summary

Implements the Global settings scope for the Drive write lease that ADR-0080 §13 designed but deferred (#1664), closing #1677:

• A new top-level lease section in settings.json (sibling of drive) for default_expiry_minutes, backup_dir, biometrics_only, and allow_headless.
• A matching OMNI_DEV_DRIVE_LEASE_* env var for each setting.
• Resolution order: CLI flag → env var → settings.json → hard-coded default (matching resolve_model's precedent), except biometrics_only/allow_headless, which are additive opt-ins (any layer saying "yes" wins).

A second commit closes gaps found in review of the first:

• The expiry-minutes resolver no longer panics on an out-of-range env/settings value (it now range-checks before constructing the chrono::Duration, instead of relying on a downstream check that never ran for this path).
• drive lease restore's audit verdict now distinguishes a headless-waived restore (restored-headless-waiver), matching acquire's existing acquired-headless-waiver verdict.
• Fixed inverted precedence order in the --help text for --backup-dir/--expiry-minutes (it said settings.json beats the env var; the code, docs, and tests all say the opposite).
• LeaseFlags::resolve() now loads settings.json once instead of twice, using the existing SettingsEnv::from_settings fix built for exactly this (chore(gmail,drive): avoid double JSON parse of error bodies and redundant settings re-reads #1533).
• Warns when the headless-auth waiver is triggered by an ambient env var or machine-wide setting (not for an explicit per-invocation --allow-headless), and when a malformed env value is silently discarded.

Test plan

• cargo build, cargo fmt --check, cargo clippy -- -D warnings all clean
• cargo test — full suite passes (one pre-existing, unrelated daemon-lifecycle flake reproduced and confirmed to pass in isolation)
• cargo insta snapshot diff reviewed and accepted — only the two intended --help line changes
• New unit tests for the expiry-minutes range check and the restore headless-waiver verdict

[github-actions]

Coverage

Total: 97.26% ⚪ 0 pp vs main

Comparing 8601fe5..fecac7c (merge-base → PR head)

File	Before	After	Δ
src/drive/lease/settings.rs	—	98.45%	🆕 new
src/cli/drive/lease.rs	99.81%	98.96%	🔴 -0.85 pp

🔇 4 ignored region(s), 0 tolerated region(s)

ignore removes the lines from both reports; tolerate keeps them in the reported percentage but scores them against the baseline, so a cross-run flip cannot move a delta. Regions are read from each revision's own source.

File	Kind	Lines	Rev	Reason
src/cli/drive/lease.rs	ignore	319-323	both	a sheet restore's fresh backup is always a DriveCopy — restore.rs's own recheck refuses unless the target is still a spreadsheet, and acquire() only ever takes a Bytes backup of a non-native target; this arm exists solely for exhaustiveness over the shared LeaseBackup enum
src/cli/drive/lease.rs	ignore	793-795	both	guards this test helper against misuse; every call site below passes an acquire subcommand
src/drive/lease/ledger.rs	ignore	620-624	both	mutate_locked refuses before ever calling the closure, so its body never runs — a hit here is a regression, not a coverage gap
src/drive/lease/restore.rs	ignore	977-981	both	every test using this double refuses before authenticating; a hit here is a regression, not a coverage gap

Patch coverage

Patch: 97.82% (403/412 new lines covered)

File	Patch	Uncovered new lines
src/cli/drive/lease.rs	94.79% (91/96)	129, 335-338
src/drive/lease/acquire.rs	98% (49/50)	714
src/drive/lease/restore.rs	100% (41/41)	—
src/drive/lease/settings.rs	98.45% (190/193)	68, 70, 74
src/utils/settings.rs	100% (32/32)	—

Uncovered new lines (9)

• src/cli/drive/lease.rs:129
• src/cli/drive/lease.rs:335
• src/cli/drive/lease.rs:336
• src/cli/drive/lease.rs:337
• src/cli/drive/lease.rs:338
• src/drive/lease/acquire.rs:714
• src/drive/lease/settings.rs:68
• src/drive/lease/settings.rs:70
• src/drive/lease/settings.rs:74

_{📦 Full per-file coverage summary · run summary}