Server overhaul: shared helpers, dead code, synchronous tasks::start, stale comments

crate::lock replaces three poison-tolerant lock helpers; the rate limiter reuses auth::bearer_token; the landing page
reuses invites::display_code. Removed: AppError::not_implemented (D-004 placeholder, only its own test used it) and
the unused Mutation::mutation_id/entity_type. tasks::start never awaited or failed: now a plain fn returning AppState.
Milestone-ownership comments (M2a/M3/M4) rewritten to say what the code does.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B

server/crates/kvitt-server/src/api/landing.rs

@@ -12,7 +12,7 @@ use axum::response::{IntoResponse, Response};
 use percent_encoding::{NON_ALPHANUMERIC, percent_decode_str, utf8_percent_encode};
 
 use crate::AppState;
-use crate::api::invites::FROM_PARAM;
+use crate::api::invites::{FROM_PARAM, display_code};
 use crate::api::{apk, validate};
 
 /// Longest code the page accepts (E-4).
@@ -110,15 +110,6 @@ fn clean_code(code: &str) -> String {
         .collect()
 }
 
-fn grouped(code: &str) -> String {
-    let chars: Vec<char> = code.chars().collect();
-    chars
-        .chunks(4)
-        .map(|c| c.iter().collect::<String>())
-        .collect::<Vec<_>>()
-        .join("-")
-}
-
 const STYLE: &str = "body{font-family:system-ui,sans-serif;max-width:28rem;margin:3rem auto;padding:0 1rem;\
 text-align:center;color:#1b1b1b;background:#fff}h1{font-size:2rem}.code{font-family:monospace;font-size:1.5rem;\
 letter-spacing:.1em;margin:1.5rem 0}a.button{display:block;margin:.75rem 0;padding:.9rem;border-radius:.75rem;\
@@ -184,7 +175,7 @@ pub fn render(
         lang = copy.html_lang,
         app = copy.app_name,
         instruction = copy.instruction,
-        code = escape(&grouped(&code)),
+        code = escape(&display_code(&code)),
         open = escape(&open_url),
         open_label = copy.open,
     )