M4: sync pull and push (E-31, E-32), audit writer and diff, FCM sender, push batching, scheduler, pruning, rotate-epoch

- src/sync/: pull with UNION ALL paging and cursor_ahead; push processing of SPEC §14.4.4 steps 1 to 12 in one
  BEGIN IMMEDIATE with a savepoint per mutation, LWW with delete-wins, tombstones, clock_skew, replay from
  sync_mutations, sync_batch for more than 3 notifiable changes; 90-day pruning.
- src/audit/: SqlAuditWriter and the §14.4.7 diff (now the default in AppState::new).
- src/push/: bounded PushHub (100, drop oldest), FCM HTTP v1 client with service-account JWT (RS256, jsonwebtoken
  on aws-lc-rs) and token cache, sender with 1/5/25 s retries and token clearing; disabled without credentials.
- src/tasks/: start installs push and spawns the 06:00 generation (and at start) and 04:00 pruning loops on the
  injectable clock.
- cli: rotate-epoch; serve uses into_make_service_with_connect_info; stale doc comments updated; /i/ empty code
  gets the HTML 404.
- tests: sync_api, push_fcm (local stub of Google's endpoints), scheduler_daily; skeleton routes test now asserts
  no route is 501.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B

server/crates/kvitt-server/src/audit/mod.rs

@@ -1,5 +1,5 @@
-//! The audit log seam (SPEC §14.4.7). M2a defines the trait and a no-op; M4 owns `src/audit/**` and replaces the
-//! implementation with one that computes the field diff and inserts the `audit_log` row.
+//! The audit log (SPEC §14.4.7, FR-12). M2a defined the trait; M4 owns `src/audit/**` and implements it with
+//! [`SqlAuditWriter`], which computes the field diff ([`diff::changes`]) and inserts the `audit_log` row.
 //!
 //! Callers (sync push in M4, recurring generation in E-28 and the scheduler, the importer in M9) call
 //! [`AuditWriter::write`] inside their own `BEGIN IMMEDIATE` transaction, passing the wire object before and after
@@ -12,9 +12,12 @@ use std::pin::Pin;
 use sqlx::SqliteConnection;
 use uuid::Uuid;
 
+use crate::db;
 use crate::error::AppError;
 use crate::wire::{AuditAction, AuditSource, EntityType};
 
+pub mod diff;
+
 /// A boxed, sendable future (object-safe async trait methods).
 pub type BoxFuture<'a, T> = Pin<Box<dyn Future<Output = T> + Send + 'a>>;
 
@@ -48,16 +51,45 @@ pub trait AuditWriter: Send + Sync + 'static {
     ) -> BoxFuture<'a, Result<Uuid, AppError>>;
 }
 
-/// Writes nothing. Used until M4 lands its writer.
+/// The real writer: derives `changes` per SPEC §14.4.7 and appends one `audit_log` row (never updated or deleted,
+/// AC-12.1) with a UUIDv7 id and a `server_version` taken on the caller's transaction.
 #[derive(Debug, Clone, Copy, Default)]
-pub struct NoopAuditWriter;
+pub struct SqlAuditWriter;
 
-impl AuditWriter for NoopAuditWriter {
+impl AuditWriter for SqlAuditWriter {
     fn write<'a>(
         &'a self,
-        _conn: &'a mut SqliteConnection,
-        _event: AuditEvent,
+        conn: &'a mut SqliteConnection,
+        event: AuditEvent,
     ) -> BoxFuture<'a, Result<Uuid, AppError>> {
-        Box::pin(async { Ok(Uuid::now_v7()) })
+        Box::pin(async move {
+            let changes = diff::changes(
+                event.entity_type,
+                event.action,
+                event.before.as_ref(),
+                &event.after,
+            );
+            let changes_json = serde_json::to_string(&changes).map_err(AppError::internal)?;
+            let id = Uuid::now_v7();
+            let version = db::next_server_version(&mut *conn).await?;
+            sqlx::query(
+                "INSERT INTO audit_log (id, entity_type, entity_id, action, source, actor_user_id, actor_device_id, \
+                 client_at, server_at, changes, server_version) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",
+            )
+            .bind(id.to_string())
+            .bind(event.entity_type.as_str())
+            .bind(event.entity_id.to_string())
+            .bind(event.action.as_str())
+            .bind(event.source.as_str())
+            .bind(event.actor_user_id.to_string())
+            .bind(event.actor_device_id.map(|d| d.to_string()))
+            .bind(&event.client_at)
+            .bind(&event.server_at)
+            .bind(changes_json)
+            .bind(version)
+            .execute(&mut *conn)
+            .await?;
+            Ok(id)
+        })
     }
 }