Server: web client under /app/ (D-132), analytics E-34 trends and E-35 forecast (D-133)

Part A (D-132): KVITT_WEB_DIR (default /app) served under /app/ by a small handler: /app redirects to
/app/, app routes fall back to index.html, a missing assets/* file is 404, assets cached immutable,
index.html no-store, the app's own CSP plus nosniff, DENY and no-referrer. Unsafe paths never reach the
file system. /app paths count against the unauthenticated per-IP limit. Without the directory every /app
path stays 404 not_found. server/Dockerfile gains a Node 24 LTS stage (pinned by digest) building web/,
passed through the Rust stage so npm and rustc never run at once on the Pi 3; the build context is the
repository root with an allowlist .dockerignore (server/.dockerignore removed); workflow, build-images.sh
and infra/dev/build.sh follow.

Part B (D-133): GET /analytics/trends (E-34) and GET /analytics/forecast (E-35), authenticated, read-only,
SQL month buckets; rules (half-up average, trailing 3-month moving average, percent against the rounded
average, template occurrence per month) in kvitt-domain::analytics. OpenAPI, examples, contracts-check
and tests updated (35 operations).

Cargo.lock: rustls-webpki 0.103.16 and webpki-root-certs 1.0.10 (RUSTSEC-2026-0382, -0383) so that
cargo audit passes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B

server/crates/kvitt-server/src/openapi.rs

@@ -85,6 +85,8 @@ const SERVER_VERSION_HEADER: &str = "X-Kvitt-Server-Version";
         api::sync::sync_pull,
         api::sync::sync_push,
         api::proposal::propose_settlement,
+        api::analytics::get_trends,
+        api::analytics::get_forecast,
     ),
     components(
         schemas(
@@ -96,6 +98,8 @@ const SERVER_VERSION_HEADER: &str = "X-Kvitt-Server-Version";
             wire::IntSchema,
             wire::PictureSizeSchema,
             wire::SyncLimitSchema,
+            wire::AnalyticsMeasureParamSchema,
+            wire::AnalyticsMonthsSchema,
         ),
         responses(
             responses::BadRequest,