M4: sync pull and push (E-31, E-32), audit writer and diff, FCM sender, push batching, scheduler, pruning, rotate-epoch

- src/sync/: pull with UNION ALL paging and cursor_ahead; push processing of SPEC §14.4.4 steps 1 to 12 in one
  BEGIN IMMEDIATE with a savepoint per mutation, LWW with delete-wins, tombstones, clock_skew, replay from
  sync_mutations, sync_batch for more than 3 notifiable changes; 90-day pruning.
- src/audit/: SqlAuditWriter and the §14.4.7 diff (now the default in AppState::new).
- src/push/: bounded PushHub (100, drop oldest), FCM HTTP v1 client with service-account JWT (RS256, jsonwebtoken
  on aws-lc-rs) and token cache, sender with 1/5/25 s retries and token clearing; disabled without credentials.
- src/tasks/: start installs push and spawns the 06:00 generation (and at start) and 04:00 pruning loops on the
  injectable clock.
- cli: rotate-epoch; serve uses into_make_service_with_connect_info; stale doc comments updated; /i/ empty code
  gets the HTML 404.
- tests: sync_api, push_fcm (local stub of Google's endpoints), scheduler_daily; skeleton routes test now asserts
  no route is 501.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B

server/crates/kvitt-server/src/sync/mod.rs

@@ -0,0 +1,31 @@
+//! The sync protocol v1 (SPEC §14.4): pull ([`pull`]), push processing ([`push`]) with the validation of step 8
+//! ([`check`]), and the daily pruning of `sync_mutations` ([`prune_mutations`]). The HTTP handlers are in
+//! `api/sync.rs`.
+
+pub mod check;
+pub mod pull;
+pub mod push;
+pub mod rows;
+
+use chrono::{DateTime, Duration, Utc};
+
+use crate::db::{self, Db};
+use crate::error::AppError;
+use crate::time::format_ts;
+
+/// How long `sync_mutations` rows are kept (SPEC §14.4.9, D-021).
+pub const MUTATION_RETENTION: Duration = Duration::days(90);
+
+/// Deletes the `sync_mutations` rows whose `received_at` is older than 90 days before `now` (SPEC §14.1). Returns
+/// the number of rows deleted. Timestamps are in the fixed RFC 3339 form, so text order is time order.
+pub async fn prune_mutations(db: &Db, now: DateTime<Utc>) -> Result<u64, AppError> {
+    let cutoff = format_ts(now - MUTATION_RETENTION);
+    let mut tx = db::begin_immediate(db).await?;
+    let deleted = sqlx::query("DELETE FROM sync_mutations WHERE received_at < ?")
+        .bind(cutoff)
+        .execute(&mut *tx)
+        .await?
+        .rows_affected();
+    tx.commit().await?;
+    Ok(deleted)
+}