M4: sync pull and push (E-31, E-32), audit writer and diff, FCM sender, push batching, scheduler, pruning, rotate-epoch

- src/sync/: pull with UNION ALL paging and cursor_ahead; push processing of SPEC §14.4.4 steps 1 to 12 in one
  BEGIN IMMEDIATE with a savepoint per mutation, LWW with delete-wins, tombstones, clock_skew, replay from
  sync_mutations, sync_batch for more than 3 notifiable changes; 90-day pruning.
- src/audit/: SqlAuditWriter and the §14.4.7 diff (now the default in AppState::new).
- src/push/: bounded PushHub (100, drop oldest), FCM HTTP v1 client with service-account JWT (RS256, jsonwebtoken
  on aws-lc-rs) and token cache, sender with 1/5/25 s retries and token clearing; disabled without credentials.
- src/tasks/: start installs push and spawns the 06:00 generation (and at start) and 04:00 pruning loops on the
  injectable clock.
- cli: rotate-epoch; serve uses into_make_service_with_connect_info; stale doc comments updated; /i/ empty code
  gets the HTML 404.
- tests: sync_api, push_fcm (local stub of Google's endpoints), scheduler_daily; skeleton routes test now asserts
  no route is 501.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B

server/crates/kvitt-server/tests/sync_api/conflicts.rs

@@ -0,0 +1,173 @@
+//! The §9.10 conflict cases, end to end through E-32 and E-31.
+
+use serde_json::json;
+
+use crate::common::*;
+use crate::m4::*;
+
+const T0: &str = "2026-10-17T10:00:00.000Z";
+
+fn edit(id: &str, at: &str, description: &str) -> serde_json::Value {
+    let mut e = expense(id, at);
+    e["created_at"] = json!(T0);
+    e["description"] = json!(description);
+    e
+}
+
+fn delete(id: &str, at: &str) -> serde_json::Value {
+    let mut e = expense(id, at);
+    e["created_at"] = json!(T0);
+    e["deleted_at"] = json!(at);
+    e
+}
+
+#[tokio::test]
+async fn both_users_edit_offline_the_later_updated_at_wins_in_either_arrival_order() {
+    for later_arrives_first in [true, false] {
+        let app = crate::m4::app().await;
+        let id = new_id();
+        push_one(&app, &admin_token(), exp(expense(&id, T0))).await;
+        let anna = exp(edit(&id, "2026-10-17T11:00:00.000Z", "Anna's"));
+        let jacob = exp(edit(&id, "2026-10-17T11:05:00.000Z", "Jacob's"));
+        if later_arrives_first {
+            accepted(&push_one(&app, &admin_token(), jacob).await);
+            let r = push_one(&app, &member_token(), anna).await;
+            rejected(&r, "stale");
+            assert_eq!(r["current"]["description"], "Jacob's");
+        } else {
+            accepted(&push_one(&app, &member_token(), anna).await);
+            accepted(&push_one(&app, &admin_token(), jacob).await);
+        }
+        let page = pull(&app, &member_token(), 0, None).await.json;
+        assert_eq!(page["expenses"][0]["description"], "Jacob's");
+        // Only accepted edits are logged; the winning edit is the last one.
+        let audit = audit_of(&app, &id).await;
+        assert_eq!(audit.last().unwrap().changes[0]["new"], "Jacob's");
+        assert_eq!(audit.len(), if later_arrives_first { 2 } else { 3 });
+    }
+}
+
+#[tokio::test]
+async fn one_deletes_the_other_edits_delete_wins_regardless_of_order_and_timestamps() {
+    // Delete first, then a newer edit: rejected deleted.
+    let app = crate::m4::app().await;
+    let id = new_id();
+    push_one(&app, &admin_token(), exp(expense(&id, T0))).await;
+    accepted(
+        &push_one(
+            &app,
+            &admin_token(),
+            exp(delete(&id, "2026-10-17T11:00:00.000Z")),
+        )
+        .await,
+    );
+    let r = push_one(
+        &app,
+        &member_token(),
+        exp(edit(&id, "2026-10-17T11:30:00.000Z", "edit")),
+    )
+    .await;
+    rejected(&r, "deleted");
+    // Edit first, then an older delete: applied.
+    let app = crate::m4::app().await;
+    let id = new_id();
+    push_one(&app, &admin_token(), exp(expense(&id, T0))).await;
+    accepted(
+        &push_one(
+            &app,
+            &member_token(),
+            exp(edit(&id, "2026-10-17T11:30:00.000Z", "edit")),
+        )
+        .await,
+    );
+    let entity = accepted(
+        &push_one(
+            &app,
+            &admin_token(),
+            exp(delete(&id, "2026-10-17T11:00:00.000Z")),
+        )
+        .await,
+    );
+    assert_eq!(entity["deleted_at"], "2026-10-17T11:00:00.000Z");
+    assert_eq!(entity["description"], "edit");
+}
+
+#[tokio::test]
+async fn same_user_on_two_devices_is_lww_per_row() {
+    let app = crate::m4::app().await;
+    // A second, non-revoked device of the admin.
+    let second = token('S');
+    app.insert_device(
+        "0192a001-0000-7000-8000-000000000009",
+        ADMIN_ID,
+        "Tablet",
+        &second,
+        None,
+    )
+    .await;
+    let id = new_id();
+    push_one(&app, &admin_token(), exp(expense(&id, T0))).await;
+    accepted(
+        &push_one(
+            &app,
+            &second,
+            exp(edit(&id, "2026-10-17T11:05:00.000Z", "tablet")),
+        )
+        .await,
+    );
+    rejected(
+        &push_one(
+            &app,
+            &admin_token(),
+            exp(edit(&id, "2026-10-17T11:00:00.000Z", "phone")),
+        )
+        .await,
+        "stale",
+    );
+}
+
+#[tokio::test]
+async fn an_expense_in_an_account_deleted_meanwhile_is_reference_not_found_archived_category_accepted()
+ {
+    let app = crate::m4::app().await;
+    tombstone(&app, "accounts", ACCOUNT_1).await;
+    rejected(
+        &push_one(&app, &admin_token(), exp(expense(&new_id(), T0))).await,
+        "reference_not_found",
+    );
+    sqlx::query("UPDATE categories SET archived_at = ? WHERE id = ?")
+        .bind(NOW)
+        .bind(GROCERIES)
+        .execute(&app.state.db)
+        .await
+        .unwrap();
+    let mut e = expense(&new_id(), T0);
+    e["account_id"] = json!(ACCOUNT_2);
+    accepted(&push_one(&app, &admin_token(), exp(e)).await);
+}
+
+#[tokio::test]
+async fn epoch_recovery_re_push_of_identical_rows_comes_back_stale_with_equal_content() {
+    // §14.4.8: after a restore the phone re-pushes everything; identical rows are stale with current equal to the
+    // pushed client-writable fields (the phone treats that as accepted), missing rows are inserted.
+    let app = crate::m4::app().await;
+    let kept = new_id();
+    let entity = expense(&kept, T0);
+    push_one(&app, &admin_token(), exp(entity.clone())).await;
+    kvitt_server::cli::rotate_epoch::rotate(&app.state.db)
+        .await
+        .unwrap();
+    let lost = new_id();
+    let reply = push(
+        &app,
+        &admin_token(),
+        vec![exp(entity.clone()), exp(expense(&lost, T0))],
+    )
+    .await;
+    let results = reply.json["results"].as_array().unwrap();
+    rejected(&results[0], "stale");
+    for (k, v) in entity.as_object().unwrap() {
+        assert_eq!(&results[0]["current"][k], v, "{k}");
+    }
+    accepted(&results[1]);
+}