Server overhaul: shared helpers, dead code, synchronous tasks::start, stale comments

crate::lock replaces three poison-tolerant lock helpers; the rate limiter reuses auth::bearer_token; the landing page
reuses invites::display_code. Removed: AppError::not_implemented (D-004 placeholder, only its own test used it) and
the unused Mutation::mutation_id/entity_type. tasks::start never awaited or failed: now a plain fn returning AppState.
Milestone-ownership comments (M2a/M3/M4) rewritten to say what the code does.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B

server/crates/kvitt-server/src/api/rate_limit.rs

@@ -21,7 +21,7 @@
 use std::collections::HashMap;
 use std::convert::Infallible;
 use std::net::{IpAddr, Ipv4Addr, SocketAddr};
-use std::sync::{Arc, Mutex, MutexGuard};
+use std::sync::{Arc, Mutex};
 use std::task::{Context, Poll};
 use std::time::Instant;
 
@@ -31,11 +31,11 @@ use axum::response::{IntoResponse, Response};
 use chrono::{DateTime, Duration, Utc};
 use tower::{Layer, Service};
 
-use crate::AppState;
 use crate::audit::BoxFuture;
-use crate::auth::{is_token_shaped, sha256_hex};
+use crate::auth::{bearer_token, is_token_shaped, sha256_hex};
 use crate::error::AppError;
 use crate::time::Clock;
+use crate::{AppState, lock};
 
 /// Unauthenticated requests per window per client IP (SPEC §8.6).
 pub const UNAUTHENTICATED_LIMIT: u32 = 60;
@@ -161,13 +161,6 @@ pub struct Limiter {
     buckets: Mutex<Buckets>,
 }
 
-fn lock<T>(mutex: &Mutex<T>) -> MutexGuard<'_, T> {
-    match mutex.lock() {
-        Ok(guard) => guard,
-        Err(poisoned) => poisoned.into_inner(),
-    }
-}
-
 impl Limiter {
     pub fn new(clock: Arc<dyn Clock>, trusted_proxy: String) -> Self {
         Self {
@@ -230,15 +223,7 @@ impl Limiter {
         if PUBLIC_ROUTES.contains(&route) || route.is_empty() {
             return Key::Ip(ip);
         }
-        let token = request
-            .headers()
-            .get(axum::http::header::AUTHORIZATION)
-            .and_then(|v| v.to_str().ok())
-            .and_then(|v| v.split_once(' '))
-            .filter(|(scheme, _)| scheme.eq_ignore_ascii_case("bearer"))
-            .map(|(_, token)| token.trim())
-            .filter(|token| is_token_shaped(token));
-        match token {
+        match bearer_token(request.headers()).filter(|token| is_token_shaped(token)) {
             Some(token) => Key::Token {
                 ip,
                 hash: sha256_hex(token),