Server: web client under /app/ (D-132), analytics E-34 trends and E-35 forecast (D-133)

Part A (D-132): KVITT_WEB_DIR (default /app) served under /app/ by a small handler: /app redirects to
/app/, app routes fall back to index.html, a missing assets/* file is 404, assets cached immutable,
index.html no-store, the app's own CSP plus nosniff, DENY and no-referrer. Unsafe paths never reach the
file system. /app paths count against the unauthenticated per-IP limit. Without the directory every /app
path stays 404 not_found. server/Dockerfile gains a Node 24 LTS stage (pinned by digest) building web/,
passed through the Rust stage so npm and rustc never run at once on the Pi 3; the build context is the
repository root with an allowlist .dockerignore (server/.dockerignore removed); workflow, build-images.sh
and infra/dev/build.sh follow.

Part B (D-133): GET /analytics/trends (E-34) and GET /analytics/forecast (E-35), authenticated, read-only,
SQL month buckets; rules (half-up average, trailing 3-month moving average, percent against the rounded
average, template occurrence per month) in kvitt-domain::analytics. OpenAPI, examples, contracts-check
and tests updated (35 operations).

Cargo.lock: rustls-webpki 0.103.16 and webpki-root-certs 1.0.10 (RUSTSEC-2026-0382, -0383) so that
cargo audit passes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B

server/crates/kvitt-domain/src/lib.rs

@@ -1,4 +1,5 @@
-//! Kvitt domain rules as pure functions (SPEC §9.1, §9.3, §9.4, §9.5 `next_occurrence_date`, §14.5).
+//! Kvitt domain rules as pure functions (SPEC §9.1, §9.3, §9.4, §9.5 `next_occurrence_date`, §14.5, and the
+//! server-side analytics rules of §14.5.7).
 //!
 //! No I/O, no clock, no randomness, no locale. Ids are plain strings (the test vectors use short ids like `"a"`);
 //! money is `i64` öre and basis points are `u32`. The Kotlin `:domain` module implements the same functions and both
@@ -8,6 +9,7 @@
 #![cfg_attr(not(test), deny(clippy::unwrap_used, clippy::expect_used))]
 
 mod allocation;
+mod analytics;
 mod balance;
 mod recurring;
 mod settlement;
@@ -17,6 +19,10 @@ pub use allocation::{
     AccountPosition, Allocation, AllocationError, AllocationProposal, over_settled_accounts,
     propose_allocation,
 };
+pub use analytics::{
+    MOVING_AVERAGE_WINDOW, average, div_half_up, moving_average, occurs_in_period,
+    percent_vs_average,
+};
 pub use balance::{BalanceExpense, BalanceSettlement, Balances, compute_balances};
 pub use recurring::{
     Period, RecurrenceError, RecurrenceSchedule, next_candidate_period, next_occurrence_date,