M2a: server workspace, kvitt-domain, skeleton routes, OpenAPI match, Dockerfile

Cargo workspace (kvitt-domain, kvitt-server, kvitt-import), Rust 1.99.1 pinned.
kvitt-domain passes every Rust vector and adds next_occurrence_date (D-015).
kvitt-server: config, SQLite pool (WAL, §8.9 pragmas), migration 0001 identical to
the contract schema, error type for all 25 codes, auth extractor and protocol
layer, all 33 routes (E-1/E-2 implemented, the rest 501), utoipa document equal
to contracts/openapi.yaml, seams for M3/M4/M9, serve/migrate/healthcheck.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/crates/kvitt-server/src/wire/device.rs

@@ -0,0 +1,40 @@
+//! Device objects (SPEC §14.3.3, §14.3.4 E-15, E-17).
+
+use serde::{Deserialize, Serialize};
+use utoipa::ToSchema;
+use uuid::Uuid;
+
+use super::{TimestampSchema, UuidSchema};
+
+/// Only in `/me`, `/devices` and `/invites/accept`.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, ToSchema)]
+pub struct Device {
+    #[schema(value_type = UuidSchema)]
+    pub id: Uuid,
+    #[schema(value_type = UuidSchema)]
+    pub user_id: Uuid,
+    pub name: String,
+    #[schema(schema_with = super::nullable_int, required = true)]
+    pub app_version_code: Option<i64>,
+    #[schema(value_type = TimestampSchema)]
+    pub created_at: String,
+    #[schema(value_type = TimestampSchema)]
+    pub last_seen_at: String,
+    #[schema(value_type = Option<TimestampSchema>, required = true)]
+    pub revoked_at: Option<String>,
+    pub is_current: bool,
+}
+
+/// E-15 `GET /devices`.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, ToSchema)]
+pub struct DeviceList {
+    pub devices: Vec<Device>,
+}
+
+/// E-17 `PUT /devices/current/push-token`: the key is required, its value nullable (null clears).
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, ToSchema)]
+pub struct PushTokenRequest {
+    #[serde(deserialize_with = "super::required_nullable")]
+    #[schema(required = true)]
+    pub fcm_token: Option<String>,
+}