M4: sync pull and push (E-31, E-32), audit writer and diff, FCM sender, push batching, scheduler, pruning, rotate-epoch

- src/sync/: pull with UNION ALL paging and cursor_ahead; push processing of SPEC §14.4.4 steps 1 to 12 in one
  BEGIN IMMEDIATE with a savepoint per mutation, LWW with delete-wins, tombstones, clock_skew, replay from
  sync_mutations, sync_batch for more than 3 notifiable changes; 90-day pruning.
- src/audit/: SqlAuditWriter and the §14.4.7 diff (now the default in AppState::new).
- src/push/: bounded PushHub (100, drop oldest), FCM HTTP v1 client with service-account JWT (RS256, jsonwebtoken
  on aws-lc-rs) and token cache, sender with 1/5/25 s retries and token clearing; disabled without credentials.
- src/tasks/: start installs push and spawns the 06:00 generation (and at start) and 04:00 pruning loops on the
  injectable clock.
- cli: rotate-epoch; serve uses into_make_service_with_connect_info; stale doc comments updated; /i/ empty code
  gets the HTML 404.
- tests: sync_api, push_fcm (local stub of Google's endpoints), scheduler_daily; skeleton routes test now asserts
  no route is 501.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B

server/crates/kvitt-server/src/api/mod.rs

@@ -1,7 +1,7 @@
 //! HTTP handlers, one file per area (SPEC §14.7), and the extractors and response types they share.
 //!
-//! M2a implements `health` (E-1) and `setup` (E-2); every other handler is registered and annotated but returns 501
-//! `not_implemented` until M3 (E-3 to E-30, E-33) and M4 (E-31, E-32) fill in the bodies.
+//! Every handler is implemented: `health` (E-1) and `setup` (E-2) by M2a, E-3 to E-30 and E-33 by M3, the sync
+//! handlers E-31 and E-32 (`sync.rs`, protocol in `crate::sync`) by M4.
 
 pub mod accounts;
 pub mod apk;
@@ -111,8 +111,3 @@ impl<S: Send + Sync> FromRequestParts<S> for IdPath {
             .ok_or_else(AppError::not_found)
     }
 }
-
-/// The body of every handler that is registered but not yet implemented (501 `not_implemented`).
-pub fn not_implemented() -> AppError {
-    AppError::not_implemented()
-}

server/crates/kvitt-server/src/api/sync.rs

@@ -1,12 +1,17 @@
-//! Sync: E-31 pull and E-32 push (SPEC §14.4).
-//!
-//! Registered and annotated by M2a; M4 owns this file and implements the handlers (until then 501
-//! `not_implemented`).
+//! Sync: E-31 pull and E-32 push (SPEC §14.4). The protocol itself is in `crate::sync`.
 
-use crate::api::not_implemented;
+use std::collections::HashMap;
+
+use axum::extract::{Query, State};
+use serde::Deserialize;
+use serde_json::Value;
+
+use crate::AppState;
+use crate::api::{ApiJson, JsonBody};
 use crate::auth::AuthDevice;
 use crate::error::AppError;
 use crate::openapi::responses::{BadRequest, Conflict, PayloadTooLarge, Unprocessable};
+use crate::sync;
 use crate::wire::{SyncLimitSchema, SyncPullResponse, SyncPushRequest, SyncPushResponse};
 
 #[utoipa::path(
@@ -25,8 +30,36 @@ use crate::wire::{SyncLimitSchema, SyncPullResponse, SyncPushRequest, SyncPushRe
         (status = 409, response = Conflict),
     )
 )]
-pub async fn sync_pull(_device: AuthDevice) -> AppError {
-    not_implemented()
+pub async fn sync_pull(
+    _device: AuthDevice,
+    State(state): State<AppState>,
+    Query(query): Query<HashMap<String, String>>,
+) -> Result<JsonBody<SyncPullResponse>, AppError> {
+    let int = |key: &str| -> Result<Option<i64>, AppError> {
+        query
+            .get(key)
+            .map(|v| {
+                v.parse::<i64>().map_err(|_| {
+                    AppError::invalid_request(format!("{key} must be an integer")).with_field(key)
+                })
+            })
+            .transpose()
+    };
+    let since = int("since")?
+        .ok_or_else(|| AppError::invalid_request("since is required").with_field("since"))?;
+    if since < 0 {
+        return Err(AppError::invalid_request("since must be 0 or more").with_field("since"));
+    }
+    let limit = sync::pull::page_size(int("limit")?)?;
+    Ok(JsonBody(sync::pull::pull(&state, since, limit).await?))
+}
+
+/// The E-32 body as the handler reads it: the mutations stay raw JSON so that a malformed mutation is rejected on
+/// its own (`validation_failed`, SPEC §14.4.4 step 3) instead of failing the request. The schema in the OpenAPI
+/// document is [`SyncPushRequest`].
+#[derive(Debug, Deserialize)]
+pub struct RawPushRequest {
+    pub mutations: Vec<Value>,
 }
 
 #[utoipa::path(
@@ -44,6 +77,12 @@ pub async fn sync_pull(_device: AuthDevice) -> AppError {
         (status = 422, response = Unprocessable),
     )
 )]
-pub async fn sync_push(_device: AuthDevice) -> AppError {
-    not_implemented()
+pub async fn sync_push(
+    device: AuthDevice,
+    State(state): State<AppState>,
+    ApiJson(body): ApiJson<RawPushRequest>,
+) -> Result<JsonBody<sync::push::PushResponse>, AppError> {
+    Ok(JsonBody(
+        sync::push::push(&state, &device, body.mutations).await?,
+    ))
 }