M4: sync pull and push (E-31, E-32), audit writer and diff, FCM sender, push batching, scheduler, pruning, rotate-epoch

- src/sync/: pull with UNION ALL paging and cursor_ahead; push processing of SPEC §14.4.4 steps 1 to 12 in one
  BEGIN IMMEDIATE with a savepoint per mutation, LWW with delete-wins, tombstones, clock_skew, replay from
  sync_mutations, sync_batch for more than 3 notifiable changes; 90-day pruning.
- src/audit/: SqlAuditWriter and the §14.4.7 diff (now the default in AppState::new).
- src/push/: bounded PushHub (100, drop oldest), FCM HTTP v1 client with service-account JWT (RS256, jsonwebtoken
  on aws-lc-rs) and token cache, sender with 1/5/25 s retries and token clearing; disabled without credentials.
- src/tasks/: start installs push and spawns the 06:00 generation (and at start) and 04:00 pruning loops on the
  injectable clock.
- cli: rotate-epoch; serve uses into_make_service_with_connect_info; stale doc comments updated; /i/ empty code
  gets the HTML 404.
- tests: sync_api, push_fcm (local stub of Google's endpoints), scheduler_daily; skeleton routes test now asserts
  no route is 501.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B

server/crates/kvitt-server/src/push/mod.rs

@@ -1,11 +1,20 @@
-//! The push notification seam (SPEC §14.6). M2a defines the trait and a no-op; M4 owns `src/push/**` and replaces
-//! the implementation with the bounded queue and FCM sender.
+//! Push notifications (SPEC §14.6). M2a defined the trait; M4 owns `src/push/**` and implements it with the bounded
+//! queue [`PushHub`] drained by the FCM [`Sender`] (started by `tasks::start`). [`NoopPushQueue`] remains for push
+//! disabled (no credentials file).
 //!
 //! [`PushQueue::enqueue`] never blocks and never fails the caller: sending happens on a background task and never
 //! delays an HTTP response (SPEC §14.6). Call it after the write transaction has committed.
 
 use uuid::Uuid;
 
+pub mod fcm;
+pub mod queue;
+pub mod sender;
+
+pub use fcm::{Endpoints, FcmClient};
+pub use queue::PushHub;
+pub use sender::{RetryPolicy, Sender};
+
 /// The notification types of SPEC §14.6 (exhaustive).
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
 pub enum PushType {
@@ -52,7 +61,7 @@ pub trait PushQueue: Send + Sync + 'static {
     fn enqueue(&self, message: PushMessage);
 }
 
-/// Drops every message. Used until M4 lands the sender, and when push is disabled.
+/// Drops every message: push disabled (no FCM credentials).
 #[derive(Debug, Clone, Copy, Default)]
 pub struct NoopPushQueue;