M4: sync pull and push (E-31, E-32), audit writer and diff, FCM sender, push batching, scheduler, pruning, rotate-epoch

- src/sync/: pull with UNION ALL paging and cursor_ahead; push processing of SPEC §14.4.4 steps 1 to 12 in one
  BEGIN IMMEDIATE with a savepoint per mutation, LWW with delete-wins, tombstones, clock_skew, replay from
  sync_mutations, sync_batch for more than 3 notifiable changes; 90-day pruning.
- src/audit/: SqlAuditWriter and the §14.4.7 diff (now the default in AppState::new).
- src/push/: bounded PushHub (100, drop oldest), FCM HTTP v1 client with service-account JWT (RS256, jsonwebtoken
  on aws-lc-rs) and token cache, sender with 1/5/25 s retries and token clearing; disabled without credentials.
- src/tasks/: start installs push and spawns the 06:00 generation (and at start) and 04:00 pruning loops on the
  injectable clock.
- cli: rotate-epoch; serve uses into_make_service_with_connect_info; stale doc comments updated; /i/ empty code
  gets the HTML 404.
- tests: sync_api, push_fcm (local stub of Google's endpoints), scheduler_daily; skeleton routes test now asserts
  no route is 501.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B

server/crates/kvitt-server/src/router.rs

@@ -5,8 +5,8 @@
 use std::time::Instant;
 
 use axum::Router;
-use axum::extract::{DefaultBodyLimit, MatchedPath, Request};
-use axum::http::HeaderValue;
+use axum::extract::{DefaultBodyLimit, MatchedPath, Path, Request, State};
+use axum::http::{HeaderMap, HeaderValue};
 use axum::middleware::{self, Next};
 use axum::response::{IntoResponse, Response};
 use axum::routing::{get, post, put};
@@ -33,6 +33,8 @@ pub fn router(state: AppState) -> Router {
         .route("/setup/status", get(setup::get_setup_status))
         .route("/invites/accept", post(invites::accept_invite))
         .route("/i/{code}", get(landing::get_invite_landing))
+        // `/i/` with an empty code: the landing page's HTML 404, not the JSON fallback.
+        .route("/i/", get(empty_invite_code))
         .route("/apk/latest", get(apk::get_apk_latest))
         .route("/apk/files/{file_name}", get(apk::get_apk_file));
 
@@ -110,6 +112,11 @@ pub fn router(state: AppState) -> Router {
         .with_state(state)
 }
 
+/// `GET /i/`: E-4 with an empty code, which the landing handler answers with its HTML 404 page.
+async fn empty_invite_code(state: State<AppState>, headers: HeaderMap) -> Response {
+    landing::get_invite_landing(state, headers, Path(String::new())).await
+}
+
 /// Unknown paths: 404 `not_found` in the error shape.
 async fn fallback() -> AppError {
     AppError::not_found()