M4: sync pull and push (E-31, E-32), audit writer and diff, FCM sender, push batching, scheduler, pruning, rotate-epoch

- src/sync/: pull with UNION ALL paging and cursor_ahead; push processing of SPEC §14.4.4 steps 1 to 12 in one
  BEGIN IMMEDIATE with a savepoint per mutation, LWW with delete-wins, tombstones, clock_skew, replay from
  sync_mutations, sync_batch for more than 3 notifiable changes; 90-day pruning.
- src/audit/: SqlAuditWriter and the §14.4.7 diff (now the default in AppState::new).
- src/push/: bounded PushHub (100, drop oldest), FCM HTTP v1 client with service-account JWT (RS256, jsonwebtoken
  on aws-lc-rs) and token cache, sender with 1/5/25 s retries and token clearing; disabled without credentials.
- src/tasks/: start installs push and spawns the 06:00 generation (and at start) and 04:00 pruning loops on the
  injectable clock.
- cli: rotate-epoch; serve uses into_make_service_with_connect_info; stale doc comments updated; /i/ empty code
  gets the HTML 404.
- tests: sync_api, push_fcm (local stub of Google's endpoints), scheduler_daily; skeleton routes test now asserts
  no route is 501.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B

server/crates/kvitt-server/tests/skeleton/routes.rs

@@ -1,5 +1,5 @@
-//! Every route of SPEC §7 is registered; E-1 and E-2 work; the rest answer 501 `not_implemented` behind the
-//! protocol rule (SPEC §14.3.1) and the auth extractor (SPEC §8.2, §8.4).
+//! Every route of SPEC §7 is registered and implemented (none answers 501), behind the protocol rule (SPEC §14.3.1)
+//! and the auth extractor (SPEC §8.2, §8.4).
 
 use axum::Router;
 use axum::body::Body;
@@ -72,7 +72,7 @@ fn assert_error(reply: &Reply, status: StatusCode, code: &str) {
 }
 
 #[tokio::test]
-async fn every_route_is_registered_and_answers_501_until_implemented() {
+async fn every_route_is_registered_and_implemented() {
     let app = TestApp::household().await;
     let routes = authenticated_routes();
     assert_eq!(
@@ -80,20 +80,12 @@ async fn every_route_is_registered_and_answers_501_until_implemented() {
         33,
         "SPEC §7 has 33 operations"
     );
-    // M3 implemented E-3 to E-30 and E-33 (tests/core_api); only M4's sync routes still answer 501.
-    for (method, path, _) in routes
-        .into_iter()
-        .filter(|(_, p, _)| p.starts_with("/sync"))
-    {
+    // M3 implemented E-3 to E-30 and E-33 (tests/core_api), M4 the sync routes (tests/sync_api): nothing is 501.
+    for (method, path, _) in routes {
         let reply = app
             .send(authed(method.clone(), &path, &admin_token()))
             .await;
-        assert_error(&reply, StatusCode::NOT_IMPLEMENTED, "not_implemented");
-        assert_eq!(
-            reply.json,
-            json!({"code": "not_implemented", "message": "not implemented", "field": null}),
-            "{method} {path}"
-        );
+        assert_ne!(reply.status, StatusCode::NOT_IMPLEMENTED, "{method} {path}");
         assert_eq!(
             reply.headers["x-kvitt-server-version"],
             env!("CARGO_PKG_VERSION")