Server: web client under /app/ (D-132), analytics E-34 trends and E-35 forecast (D-133)

Part A (D-132): KVITT_WEB_DIR (default /app) served under /app/ by a small handler: /app redirects to
/app/, app routes fall back to index.html, a missing assets/* file is 404, assets cached immutable,
index.html no-store, the app's own CSP plus nosniff, DENY and no-referrer. Unsafe paths never reach the
file system. /app paths count against the unauthenticated per-IP limit. Without the directory every /app
path stays 404 not_found. server/Dockerfile gains a Node 24 LTS stage (pinned by digest) building web/,
passed through the Rust stage so npm and rustc never run at once on the Pi 3; the build context is the
repository root with an allowlist .dockerignore (server/.dockerignore removed); workflow, build-images.sh
and infra/dev/build.sh follow.

Part B (D-133): GET /analytics/trends (E-34) and GET /analytics/forecast (E-35), authenticated, read-only,
SQL month buckets; rules (half-up average, trailing 3-month moving average, percent against the rounded
average, template occurrence per month) in kvitt-domain::analytics. OpenAPI, examples, contracts-check
and tests updated (35 operations).

Cargo.lock: rustls-webpki 0.103.16 and webpki-root-certs 1.0.10 (RUSTSEC-2026-0382, -0383) so that
cargo audit passes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B

server/crates/kvitt-domain/src/recurring.rs

@@ -60,6 +60,15 @@ impl Period {
         }
     }
 
+    /// The month before, or `None` before 0001-01.
+    pub fn previous(self) -> Option<Self> {
+        if self.month == 1 {
+            Self::new(self.year.checked_sub(1)?, 12)
+        } else {
+            Self::new(self.year, self.month - 1)
+        }
+    }
+
     /// Number of days in this month (Gregorian leap years).
     pub fn days(self) -> u8 {
         match self.month {
@@ -184,6 +193,15 @@ mod tests {
         next_occurrence_date(s).unwrap()
     }
 
+    #[test]
+    fn previous_month() {
+        let p = |s: &str| s.parse::<Period>().unwrap();
+        assert_eq!(p("2026-03").previous(), Some(p("2026-02")));
+        assert_eq!(p("2026-01").previous(), Some(p("2025-12")));
+        assert_eq!(p("0001-01").previous(), None);
+        assert_eq!(p("2025-12").next(), Some(p("2026-01")));
+    }
+
     #[test]
     fn never_generated_starts_at_start_period() {
         assert_eq!(