M2a: server workspace, kvitt-domain, skeleton routes, OpenAPI match, Dockerfile

Cargo workspace (kvitt-domain, kvitt-server, kvitt-import), Rust 1.99.1 pinned.
kvitt-domain passes every Rust vector and adds next_occurrence_date (D-015).
kvitt-server: config, SQLite pool (WAL, §8.9 pragmas), migration 0001 identical to
the contract schema, error type for all 25 codes, auth extractor and protocol
layer, all 33 routes (E-1/E-2 implemented, the rest 501), utoipa document equal
to contracts/openapi.yaml, seams for M3/M4/M9, serve/migrate/healthcheck.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/crates/kvitt-server/src/api/apk.rs

@@ -0,0 +1,42 @@
+//! E-5 latest APK metadata and E-6 APK download (SPEC §10.6).
+//!
+//! Registered and annotated by M2a; M3 owns this file and implements the handlers (until then 501
+//! `not_implemented`).
+
+use crate::api::not_implemented;
+use crate::error::AppError;
+use crate::openapi::responses::NotFound;
+use crate::wire::{ApkBytes, ApkLatest, IntSchema};
+
+#[utoipa::path(
+    get,
+    path = "/apk/latest",
+    operation_id = "getApkLatest",
+    summary = "E-5 Latest APK metadata",
+    security(()),
+    responses(
+        (status = 200, description = "The content of `latest.json` (SPEC §10.6), read on every request.", body = ApkLatest, content_type = "application/json; charset=utf-8"),
+        (status = 404, response = NotFound),
+    )
+)]
+pub async fn get_apk_latest() -> AppError {
+    not_implemented()
+}
+
+#[utoipa::path(
+    get,
+    path = "/apk/files/{file_name}",
+    operation_id = "getApkFile",
+    summary = "E-6 APK download",
+    security(()),
+    params(
+        ("file_name" = String, Path, description = "Served only when it matches `^kvitt-[0-9]+\\.apk$` and exists (SPEC §10.6)."),
+    ),
+    responses(
+        (status = 200, description = "The APK bytes.", body = ApkBytes, content_type = "application/vnd.android.package-archive", headers(("Content-Length" = IntSchema))),
+        (status = 404, response = NotFound),
+    )
+)]
+pub async fn get_apk_file() -> AppError {
+    not_implemented()
+}