M4: sync pull and push (E-31, E-32), audit writer and diff, FCM sender, push batching, scheduler, pruning, rotate-epoch

- src/sync/: pull with UNION ALL paging and cursor_ahead; push processing of SPEC §14.4.4 steps 1 to 12 in one
  BEGIN IMMEDIATE with a savepoint per mutation, LWW with delete-wins, tombstones, clock_skew, replay from
  sync_mutations, sync_batch for more than 3 notifiable changes; 90-day pruning.
- src/audit/: SqlAuditWriter and the §14.4.7 diff (now the default in AppState::new).
- src/push/: bounded PushHub (100, drop oldest), FCM HTTP v1 client with service-account JWT (RS256, jsonwebtoken
  on aws-lc-rs) and token cache, sender with 1/5/25 s retries and token clearing; disabled without credentials.
- src/tasks/: start installs push and spawns the 06:00 generation (and at start) and 04:00 pruning loops on the
  injectable clock.
- cli: rotate-epoch; serve uses into_make_service_with_connect_info; stale doc comments updated; /i/ empty code
  gets the HTML 404.
- tests: sync_api, push_fcm (local stub of Google's endpoints), scheduler_daily; skeleton routes test now asserts
  no route is 501.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B

server/crates/kvitt-server/src/push/queue.rs

@@ -0,0 +1,75 @@
+//! The bounded push queue (SPEC §14.6): capacity 100, the oldest message dropped with a warning when full.
+//! [`PushQueue::enqueue`] never blocks; the sender task waits on [`PushHub::next`].
+
+use std::collections::VecDeque;
+use std::sync::{Mutex, MutexGuard};
+
+use tokio::sync::Notify;
+
+use super::{PushMessage, PushQueue};
+
+/// Queue capacity (SPEC §14.6).
+pub const QUEUE_CAPACITY: usize = 100;
+
+/// The queue between the request handlers (and the scheduler) and the sender task.
+#[derive(Debug, Default)]
+pub struct PushHub {
+    queue: Mutex<VecDeque<PushMessage>>,
+    notify: Notify,
+}
+
+impl PushHub {
+    pub fn new() -> Self {
+        Self::default()
+    }
+
+    fn lock(&self) -> MutexGuard<'_, VecDeque<PushMessage>> {
+        match self.queue.lock() {
+            Ok(guard) => guard,
+            Err(poisoned) => poisoned.into_inner(),
+        }
+    }
+
+    /// Messages waiting.
+    pub fn len(&self) -> usize {
+        self.lock().len()
+    }
+
+    pub fn is_empty(&self) -> bool {
+        self.len() == 0
+    }
+
+    /// The oldest waiting message, if any.
+    pub fn pop(&self) -> Option<PushMessage> {
+        self.lock().pop_front()
+    }
+
+    /// Waits for the next message.
+    pub async fn next(&self) -> PushMessage {
+        loop {
+            if let Some(message) = self.pop() {
+                return message;
+            }
+            self.notify.notified().await;
+        }
+    }
+}
+
+impl PushQueue for PushHub {
+    fn enqueue(&self, message: PushMessage) {
+        {
+            let mut queue = self.lock();
+            if queue.len() >= QUEUE_CAPACITY
+                && let Some(dropped) = queue.pop_front()
+            {
+                tracing::warn!(
+                    push_type = dropped.push_type.as_str(),
+                    capacity = QUEUE_CAPACITY,
+                    "push queue full: oldest message dropped"
+                );
+            }
+            queue.push_back(message);
+        }
+        self.notify.notify_one();
+    }
+}