M2a: server workspace, kvitt-domain, skeleton routes, OpenAPI match, Dockerfile

Cargo workspace (kvitt-domain, kvitt-server, kvitt-import), Rust 1.99.1 pinned.
kvitt-domain passes every Rust vector and adds next_occurrence_date (D-015).
kvitt-server: config, SQLite pool (WAL, §8.9 pragmas), migration 0001 identical to
the contract schema, error type for all 25 codes, auth extractor and protocol
layer, all 33 routes (E-1/E-2 implemented, the rest 501), utoipa document equal
to contracts/openapi.yaml, seams for M3/M4/M9, serve/migrate/healthcheck.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/crates/kvitt-server/src/tasks/mod.rs

@@ -0,0 +1,11 @@
+//! Background tasks started by `serve`: the recurring scheduler (SPEC §9.5), the push sender (§14.6) and
+//! `sync_mutations` pruning (§14.1). M4 owns `src/tasks/**`; in M2a this starts nothing.
+
+use crate::AppState;
+use crate::error::AppError;
+
+/// Starts the background tasks (spawned on the runtime; this returns once they are started).
+pub async fn start(state: AppState) -> Result<(), AppError> {
+    let _ = state;
+    Ok(())
+}