Server overhaul: shared helpers, dead code, synchronous tasks::start, stale comments

crate::lock replaces three poison-tolerant lock helpers; the rate limiter reuses auth::bearer_token; the landing page
reuses invites::display_code. Removed: AppError::not_implemented (D-004 placeholder, only its own test used it) and
the unused Mutation::mutation_id/entity_type. tasks::start never awaited or failed: now a plain fn returning AppState.
Milestone-ownership comments (M2a/M3/M4) rewritten to say what the code does.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B

server/crates/kvitt-server/src/time.rs

@@ -62,19 +62,13 @@ impl FixedClock {
 
     /// Sets the instant every clone of this clock returns from now on.
     pub fn set(&self, instant: DateTime<Utc>) {
-        match self.0.lock() {
-            Ok(mut guard) => *guard = instant,
-            Err(poisoned) => *poisoned.into_inner() = instant,
-        }
+        *crate::lock(&self.0) = instant;
     }
 }
 
 impl Clock for FixedClock {
     fn now(&self) -> DateTime<Utc> {
-        match self.0.lock() {
-            Ok(guard) => *guard,
-            Err(poisoned) => *poisoned.into_inner(),
-        }
+        *crate::lock(&self.0)
     }
 }