server.rs now has its own Error enum (Io, Telemetry, Secret) with
thiserror + Diagnostic derives. main() converts at the boundary
with into_diagnostic(). No more miette in server.rs internals.

Assisted-by: Owl Alpha via pi

diff --git a/quire-ci/src/main.rs b/quire-ci/src/main.rs
index f5adf44..3205bb3 100644
--- a/quire-ci/src/main.rs
+++ b/quire-ci/src/main.rs
@@ -303,7 +303,7 @@ fn main() -> Result<()> {
                 .enable_all()
                 .build()
                 .into_diagnostic()?;
-            rt.block_on(server::run(quire))
+            rt.block_on(server::run(quire)).into_diagnostic()
         }
         Commands::Run {
             events,
diff --git a/quire-ci/src/server.rs b/quire-ci/src/server.rs
index 11baa0c..6df6f2a 100644
--- a/quire-ci/src/server.rs
+++ b/quire-ci/src/server.rs
@@ -2,7 +2,6 @@ use std::net::SocketAddr;
 
 use axum::Router;
 use axum::routing::get;
-use miette::{IntoDiagnostic, Result};
 
 use crate::quire::QuireCi;
 
@@ -16,6 +15,20 @@ async fn index() -> String {
     format!("quire-ci {VERSION}\n")
 }
 
+#[derive(Debug, thiserror::Error, miette::Diagnostic)]
+pub enum Error {
+    #[error("io error: {0}")]
+    Io(#[from] std::io::Error),
+
+    #[error("telemetry init error: {0}")]
+    Telemetry(#[from] quire_core::telemetry::Error),
+
+    #[error("secret error: {0}")]
+    Secret(#[from] quire_core::secret::Error),
+}
+
+pub type Result<T> = std::result::Result<T, Error>;
+
 pub async fn run(quire: QuireCi) -> Result<()> {
     let port = quire.config().port;
 
@@ -33,11 +46,11 @@ pub async fn run(quire: QuireCi) -> Result<()> {
     let addr = SocketAddr::from(([0, 0, 0, 0], port));
     tracing::info!(%addr, "starting HTTP server");
 
-    let listener = tokio::net::TcpListener::bind(addr)
-        .await
-        .into_diagnostic()?;
+    let listener = tokio::net::TcpListener::bind(addr).await?;
+
+    axum::serve(listener, app).await?;
 
-    axum::serve(listener, app).await.into_diagnostic()
+    Ok(())
 }
 
 /// Initialize Sentry if the global config provides a DSN.
@@ -45,7 +58,7 @@ fn init_sentry(quire: &QuireCi) -> Result<Option<sentry::ClientInitGuard>> {
     let Some(sentry_config) = quire.config().sentry.as_ref() else {
         return Ok(None);
     };
-    let dsn = sentry_config.dsn.reveal().into_diagnostic()?;
+    let dsn = sentry_config.dsn.reveal()?;
     Ok(Some(sentry::init((
         dsn,
         quire_core::telemetry::sentry_client_options(VERSION),