api_clients: use tokio::fs inside async functions (Sonar S7493) (#2803)

## Summary

Replaces blocking `std::fs` calls inside `async fn`s with `tokio::fs` in
four API client crates. SonarCloud reports these as **rust:S7493** ("use
an asynchronous file API instead of this blocking file operation"). This
PR resolves 13 of the 40 artcraft findings.

| Crate | File | Change |

|---------------------|-------------------------------------------------------------|------------------------------------------------------------|
| `artcraft_client` | `endpoints/media_files/*_from_file.rs` (4 files) |
`std::fs::read` → `tokio::fs::read(..).await` |
| `artcraft_client` | `recipes/download_media_file.rs` | `File::create`
+ `write_all` + `flush` → `tokio::fs::write` |
| `artcraft_router` | `generate_video/providers/kinovi/upload.rs` |
`std::fs::read` → `tokio::fs::read(..).await` |
| `midjourney_client` | `credentials/credential_manager.rs`
(`clear_credentials`) | `std::fs::remove_file` →
`tokio::fs::remove_file(..).await` |
| `openai_sora_client`|
`requests/deprecated/job_status/sora_job_status.rs` | `create_dir_all` /
`File::create` + `write_all` → `tokio::fs` |

The workspace `tokio` dependency enables only `macros`.
`artcraft_client` (which had `tokio` only as a dev-dependency) and
`artcraft_router` now declare `tokio = { workspace = true, features =
["fs"] }`. `midjourney_client` and `openai_sora_client` already use
`tokio` with `full`. `Cargo.lock` does not change. In
`save_generations_to_dir`, the blocking `dir.exists()` check before
`create_dir_all` is dropped, because `create_dir_all` already succeeds
when the directory exists.

The behaviour stays the same: same paths, same error mapping, and the
same `NotFound` handling in `clear_credentials`.

## Not included

- `crates/schema/database/sqlite_tasks/src/connection.rs:25` (S7493):
#2360 removes this `remove_file` entirely, so it's left to that PR.
- `crates/desktop/artcraft` (26 findings): handled in a separate PR.

#2365, #2373 and #2785 edit nearby lines in the `*_from_file.rs` upload
files (client builder, idempotency token). None of them touch the
`std::fs::read` lines. Expect at most a trivial rebase.

## Testing

Run locally on Linux x86_64 with stable Rust:

- `cargo check -p artcraft_client -p artcraft_router -p
midjourney_client -p openai_sora_client` passes.
- `cargo test` on the same four crates passes: 2555 + 39 + 16 + 6 unit
tests, with ignored tests left ignored. That includes
`midjourney_client`'s existing
`loads_a_saved_login_and_logout_removes_every_format`, which exercises
the changed `clear_credentials` path.
- `cargo clippy` on these crates reports nothing on the changed lines.
Clippy cannot finish on `main` itself: `enums` fails on
`clippy::deprecated_semver` and `openai_sora_client` fails on
`should_implement_trait` in `task_id.rs`, both pre-existing.

No new test is added. This is a non-blocking I/O refactor with identical
observable behaviour, so there is no test that fails before the change
and passes after it. The other changed paths do network I/O and have no
offline tests. Please rely on CI and the SonarCloud re-analysis to
confirm the S7493 findings close.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

<!-- coderabbit-ai-generated:v1 -->

## Summary by CodeRabbit

* **Refactor**
* File uploads and downloads, generated image saving, and
credential-file cleanup now use asynchronous file operations.
* When a local file can’t be read during a video upload, the existing
fallback to downloading from the source URL remains in place.
* Existing handling of file-read, write, and removal errors is
preserved, including ignoring missing credential files.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

crates/api_clients/artcraft/artcraft_client/Cargo.toml

@@ -33,6 +33,7 @@ chrono.workspace = true
 cookie.workspace = true
 log.workspace = true
 reqwest = { workspace = true, features = ["multipart", "gzip"] }
+tokio = { workspace = true, features = ["fs"] }
 url.workspace = true
 
 # Serialization

crates/api_clients/artcraft/artcraft_client/src/endpoints/media_files/legacy_upload_media_file_from_file.rs

@@ -60,7 +60,7 @@ pub async fn legacy_upload_media_file_from_file<P: AsRef<Path>>(
       .build()
       .map_err(|err| StorytellerError::Client(ClientError::from(err)))?;
 
-  let file_bytes = std::fs::read(args.path.as_ref())
+  let file_bytes = tokio::fs::read(args.path.as_ref()).await
       .map_err(|err| StorytellerError::Client(ClientError::from(err)))?;
   let file_name = args.path.as_ref().file_name()
       .and_then(|n| n.to_str()).unwrap_or("file").to_string();

crates/api_clients/artcraft/artcraft_client/src/endpoints/media_files/upload_image_media_file_from_file.rs

@@ -69,7 +69,7 @@ pub async fn upload_image_media_file_from_file_with_idempotency_token<P: AsRef<P
       .build()
       .map_err(|err| StorytellerError::Client(ClientError::from(err)))?;
 
-  let file_bytes = std::fs::read(args.path.as_ref())
+  let file_bytes = tokio::fs::read(args.path.as_ref()).await
       .map_err(|err| StorytellerError::Client(ClientError::from(err)))?;
   let file_name = args.path.as_ref().file_name()
       .and_then(|n| n.to_str()).unwrap_or("file").to_string();

crates/api_clients/artcraft/artcraft_client/src/endpoints/media_files/upload_new_engine_asset_from_file.rs

@@ -35,7 +35,7 @@ pub async fn upload_new_engine_asset_from_file<P: AsRef<Path>>(
   let client = storyteller_client_builder(api_host)
       .build()?;
 
-  let file_bytes = std::fs::read(path.as_ref())?;
+  let file_bytes = tokio::fs::read(path.as_ref()).await?;
   let file_name = path.as_ref().file_name()
       .and_then(|n| n.to_str()).unwrap_or("file").to_string();
   let mut form = Form::new()

crates/api_clients/artcraft/artcraft_client/src/endpoints/media_files/upload_video_media_file_from_file.rs

@@ -61,7 +61,7 @@ pub async fn upload_video_media_file_from_file<P: AsRef<Path>>(
   let client = storyteller_client_builder(args.api_host)
       .build()?;
 
-  let file_bytes = std::fs::read(args.path.as_ref())?;
+  let file_bytes = tokio::fs::read(args.path.as_ref()).await?;
   let file_name = args.path.as_ref().file_name()
       .and_then(|n| n.to_str()).unwrap_or("file").to_string();
   let mut form = Form::new()

crates/api_clients/artcraft/artcraft_client/src/recipes/download_media_file.rs

@@ -1,5 +1,3 @@
-use std::fs;
-use std::io::Write;
 use std::path::{Path, PathBuf};
 
 use log::{info, warn};
@@ -68,13 +66,7 @@ pub async fn download_media_file<P: AsRef<Path>>(
   let bytes = download_bytes(cdn_url).await?;
 
   // 4. Write to disk.
-  let mut file = fs::File::create(&output_path)
-    .map_err(|err| StorytellerError::Client(ClientError::IoError(err)))?;
-
-  file.write_all(&bytes)
-    .map_err(|err| StorytellerError::Client(ClientError::IoError(err)))?;
-
-  file.flush()
+  tokio::fs::write(&output_path, &bytes).await
     .map_err(|err| StorytellerError::Client(ClientError::IoError(err)))?;
 
   info!("Downloaded {} bytes to {:?}", bytes.len(), output_path);

crates/api_clients/artcraft/artcraft_router/Cargo.toml

@@ -31,7 +31,7 @@ reqwest.workspace = true
 serde.workspace = true
 wreq.workspace = true
 serde_derive.workspace = true
-tokio.workspace = true
+tokio = { workspace = true, features = ["fs"] }
 uuid.workspace = true
 
 [dev-dependencies]

crates/api_clients/artcraft/artcraft_router/src/generate/generate_video/providers/kinovi/upload.rs

@@ -24,7 +24,7 @@ pub(crate) async fn upload_to_kinovi_web(
       .unwrap_or_else(|| "jpg".to_string());
 
   let file_bytes = match maybe_local_path {
-    Some(local_path) => match std::fs::read(local_path) {
+    Some(local_path) => match tokio::fs::read(local_path).await {
       Ok(bytes) => {
         info!("Reusing predownloaded file for kinovi upload: {}", source_url);
         bytes

crates/api_clients/midjourney_client/src/credentials/credential_manager.rs

@@ -93,7 +93,7 @@ impl MidjourneyCredentialManager {
     let _guard = self.mutation.lock().await;
     // Remove every format, so a later startup cannot migrate a logged-out account.
     for path in self.legacy_paths.iter().chain([&self.credential_path]) {
-      match std::fs::remove_file(path) {
+      match tokio::fs::remove_file(path).await {
         Ok(()) => {},
         Err(err) if err.kind() == std::io::ErrorKind::NotFound => {},
         Err(err) => return Err(err.into()),

crates/api_clients/openai_sora_client/src/requests/deprecated/job_status/sora_job_status.rs

@@ -11,7 +11,7 @@ use errors::AnyhowResult;
 use log::{debug, error, warn};
 use serde_derive::{Deserialize, Serialize};
 use std::fmt::{Debug, Display};
-use std::{fs::File, io::Write, path::Path};
+use std::path::Path;
 use url::Url;
 use wreq::Client;
 
@@ -271,9 +271,7 @@ pub async fn get_image_gen_status(status_request: &StatusRequest, credentials: &
 
 pub async fn save_generations_to_dir(generations: &[Generation], dir: &str) -> AnyhowResult<()> {
   let dir = Path::new(dir);
-  if !dir.exists() {
-    std::fs::create_dir_all(dir)?;
-  }
+  tokio::fs::create_dir_all(dir).await?;
   for generation in generations {
     let response = wreq::get(generation.url.clone()).send().await?;
     let image_bytes = response.bytes().await?;
@@ -282,15 +280,13 @@ pub async fn save_generations_to_dir(generations: &[Generation], dir: &str) -> A
     let ext = url.path().split(".").last().unwrap_or("png");
     let path = Path::new(dir).join(format!("{}.{}", generation.id, ext));
 
-    let mut file = File::create(path)?;
-    file.write_all(&image_bytes)?;
+    tokio::fs::write(path, &image_bytes).await?;
 
     let thumbnail_url = generation.encodings.thumbnail.path.clone();
     let thumbnail_response = wreq::get(thumbnail_url).send().await?;
     let thumbnail_bytes = thumbnail_response.bytes().await?;
     let thumbnail_path = Path::new(dir).join(format!("{}_thumbnail.{}", generation.id, ext));
-    let mut thumbnail_file = File::create(thumbnail_path)?;
-    thumbnail_file.write_all(&thumbnail_bytes)?;
+    tokio::fs::write(thumbnail_path, &thumbnail_bytes).await?;
   }
 
   Ok(())