M4: sync pull and push (E-31, E-32), audit writer and diff, FCM sender, push batching, scheduler, pruning, rotate-epoch

- src/sync/: pull with UNION ALL paging and cursor_ahead; push processing of SPEC §14.4.4 steps 1 to 12 in one
  BEGIN IMMEDIATE with a savepoint per mutation, LWW with delete-wins, tombstones, clock_skew, replay from
  sync_mutations, sync_batch for more than 3 notifiable changes; 90-day pruning.
- src/audit/: SqlAuditWriter and the §14.4.7 diff (now the default in AppState::new).
- src/push/: bounded PushHub (100, drop oldest), FCM HTTP v1 client with service-account JWT (RS256, jsonwebtoken
  on aws-lc-rs) and token cache, sender with 1/5/25 s retries and token clearing; disabled without credentials.
- src/tasks/: start installs push and spawns the 06:00 generation (and at start) and 04:00 pruning loops on the
  injectable clock.
- cli: rotate-epoch; serve uses into_make_service_with_connect_info; stale doc comments updated; /i/ empty code
  gets the HTML 404.
- tests: sync_api, push_fcm (local stub of Google's endpoints), scheduler_daily; skeleton routes test now asserts
  no route is 501.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B

server/crates/kvitt-server/src/api/mod.rs

@@ -1,7 +1,7 @@
 //! HTTP handlers, one file per area (SPEC §14.7), and the extractors and response types they share.
 //!
-//! M2a implements `health` (E-1) and `setup` (E-2); every other handler is registered and annotated but returns 501
-//! `not_implemented` until M3 (E-3 to E-30, E-33) and M4 (E-31, E-32) fill in the bodies.
+//! Every handler is implemented: `health` (E-1) and `setup` (E-2) by M2a, E-3 to E-30 and E-33 by M3, the sync
+//! handlers E-31 and E-32 (`sync.rs`, protocol in `crate::sync`) by M4.
 
 pub mod accounts;
 pub mod apk;
@@ -111,8 +111,3 @@ impl<S: Send + Sync> FromRequestParts<S> for IdPath {
             .ok_or_else(AppError::not_found)
     }
 }
-
-/// The body of every handler that is registered but not yet implemented (501 `not_implemented`).
-pub fn not_implemented() -> AppError {
-    AppError::not_implemented()
-}