M2a: server workspace, kvitt-domain, skeleton routes, OpenAPI match, Dockerfile

Cargo workspace (kvitt-domain, kvitt-server, kvitt-import), Rust 1.99.1 pinned.
kvitt-domain passes every Rust vector and adds next_occurrence_date (D-015).
kvitt-server: config, SQLite pool (WAL, §8.9 pragmas), migration 0001 identical to
the contract schema, error type for all 25 codes, auth extractor and protocol
layer, all 33 routes (E-1/E-2 implemented, the rest 501), utoipa document equal
to contracts/openapi.yaml, seams for M3/M4/M9, serve/migrate/healthcheck.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/crates/kvitt-import/src/main.rs

@@ -0,0 +1,20 @@
+//! `kvitt-import`: the Splitwise CSV importer (SPEC §10.8). M9 owns this crate; in M2a it prints its usage and
+//! exits 2.
+
+// No unwrap/expect outside tests (CLAUDE.md server rule); integration tests are separate crates and may use them.
+#![cfg_attr(not(test), deny(clippy::unwrap_used, clippy::expect_used))]
+
+use std::process::ExitCode;
+
+// The importer reuses the server crate for database access and audit writing and the domain crate for the money
+// rules (SPEC §6.3); referenced here so the dependency edges exist from the start.
+use kvitt_domain as _;
+use kvitt_server as _;
+
+const USAGE: &str =
+    "usage: kvitt-import <options> (Splitwise CSV importer, SPEC §10.8; not implemented in M2a)";
+
+fn main() -> ExitCode {
+    eprintln!("{USAGE}");
+    ExitCode::from(2)
+}