Server overhaul: shared helpers, dead code, synchronous tasks::start, stale comments

crate::lock replaces three poison-tolerant lock helpers; the rate limiter reuses auth::bearer_token; the landing page
reuses invites::display_code. Removed: AppError::not_implemented (D-004 placeholder, only its own test used it) and
the unused Mutation::mutation_id/entity_type. tasks::start never awaited or failed: now a plain fn returning AppState.
Milestone-ownership comments (M2a/M3/M4) rewritten to say what the code does.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B

server/crates/kvitt-server/src/router.rs

@@ -1,6 +1,4 @@
-//! The router: every route of SPEC §7 and the layers of SPEC §14.3.1 and §8.6.
-//!
-//! M2a owns this file. M3 and M4 fill in handler bodies in their own `api/*.rs` files; the routes are all here.
+//! The router: every route of SPEC §7 and the layers of SPEC §14.3.1 and §8.6. The handlers are in `api/*.rs`.
 
 use std::time::Instant;
 
@@ -106,7 +104,7 @@ pub fn router(state: AppState) -> Router {
         .merge(authenticated)
         .fallback(fallback)
         .layer(DefaultBodyLimit::max(BODY_LIMIT_BYTES))
-        .layer(rate_limit::layer(&state)) // M3: the rate limiter of SPEC §8.6 attaches here (src/api/rate_limit.rs).
+        .layer(rate_limit::layer(&state))
         .layer(middleware::from_fn(log_request))
         .layer(middleware::map_response(add_server_version))
         .with_state(state)