Server: web client under /app/ (D-132), analytics E-34 trends and E-35 forecast (D-133)

Part A (D-132): KVITT_WEB_DIR (default /app) served under /app/ by a small handler: /app redirects to
/app/, app routes fall back to index.html, a missing assets/* file is 404, assets cached immutable,
index.html no-store, the app's own CSP plus nosniff, DENY and no-referrer. Unsafe paths never reach the
file system. /app paths count against the unauthenticated per-IP limit. Without the directory every /app
path stays 404 not_found. server/Dockerfile gains a Node 24 LTS stage (pinned by digest) building web/,
passed through the Rust stage so npm and rustc never run at once on the Pi 3; the build context is the
repository root with an allowlist .dockerignore (server/.dockerignore removed); workflow, build-images.sh
and infra/dev/build.sh follow.

Part B (D-133): GET /analytics/trends (E-34) and GET /analytics/forecast (E-35), authenticated, read-only,
SQL month buckets; rules (half-up average, trailing 3-month moving average, percent against the rounded
average, template occurrence per month) in kvitt-domain::analytics. OpenAPI, examples, contracts-check
and tests updated (35 operations).

Cargo.lock: rustls-webpki 0.103.16 and webpki-root-certs 1.0.10 (RUSTSEC-2026-0382, -0383) so that
cargo audit passes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B

server/crates/kvitt-server/tests/openapi_contract.rs

@@ -376,7 +376,7 @@ fn generated_document_equals_contract() {
             .collect::<Vec<_>>()
             .join("\n")
     );
-    // The contract has 33 operations (SPEC §7, E-1 to E-33); make sure none were lost on both sides.
+    // The contract has 35 operations (SPEC §7, E-1 to E-35); make sure none were lost on both sides.
     let count = normalise(&generated)["operations"]
         .as_object()
         .map(|paths| {
@@ -387,7 +387,7 @@ fn generated_document_equals_contract() {
                 .sum::<usize>()
         })
         .unwrap_or(0);
-    assert_eq!(count, 33);
+    assert_eq!(count, 35);
 }
 
 // The comparison itself must be strict: each mutation of the contract below must be detected.