Server overhaul: shared helpers, dead code, synchronous tasks::start, stale comments

crate::lock replaces three poison-tolerant lock helpers; the rate limiter reuses auth::bearer_token; the landing page
reuses invites::display_code. Removed: AppError::not_implemented (D-004 placeholder, only its own test used it) and
the unused Mutation::mutation_id/entity_type. tasks::start never awaited or failed: now a plain fn returning AppState.
Milestone-ownership comments (M2a/M3/M4) rewritten to say what the code does.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B

server/crates/kvitt-server/src/auth.rs

@@ -87,7 +87,8 @@ pub struct AuthDevice {
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct AdminDevice(pub AuthDevice);
 
-fn bearer_token(headers: &HeaderMap) -> Option<&str> {
+/// The token of `Authorization: Bearer <token>` (scheme case-insensitive, token trimmed), shape unchecked.
+pub fn bearer_token(headers: &HeaderMap) -> Option<&str> {
     let value = headers
         .get(axum::http::header::AUTHORIZATION)?
         .to_str()
@@ -96,7 +97,8 @@ fn bearer_token(headers: &HeaderMap) -> Option<&str> {
     scheme.eq_ignore_ascii_case("bearer").then(|| token.trim())
 }
 
-fn app_version_code(headers: &HeaderMap) -> Option<i64> {
+/// The `X-Kvitt-App-Version` value: a non-negative integer; anything else is ignored (the stored value is kept).
+pub fn app_version_code(headers: &HeaderMap) -> Option<i64> {
     headers
         .get(APP_VERSION_HEADER)?
         .to_str()