M3: server core API (E-3 to E-30, E-33), landing page, pictures, rate limiting, recurring generation, bootstrap and pair-device

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/crates/kvitt-server/tests/skeleton/routes.rs

@@ -80,7 +80,11 @@ async fn every_route_is_registered_and_answers_501_until_implemented() {
         33,
         "SPEC §7 has 33 operations"
     );
-    for (method, path, _) in routes {
+    // M3 implemented E-3 to E-30 and E-33 (tests/core_api); only M4's sync routes still answer 501.
+    for (method, path, _) in routes
+        .into_iter()
+        .filter(|(_, p, _)| p.starts_with("/sync"))
+    {
         let reply = app
             .send(authed(method.clone(), &path, &admin_token()))
             .await;
@@ -97,7 +101,7 @@ async fn every_route_is_registered_and_answers_501_until_implemented() {
     }
     for (method, path) in public_stub_routes() {
         let reply = app.send(request(method.clone(), path, None, None)).await;
-        assert_error(&reply, StatusCode::NOT_IMPLEMENTED, "not_implemented");
+        assert_ne!(reply.status, StatusCode::NOT_IMPLEMENTED, "{method} {path}");
     }
 }
 
@@ -216,7 +220,7 @@ async fn admin_only_routes_are_forbidden_for_the_member() {
         if admin_only {
             assert_error(&reply, StatusCode::FORBIDDEN, "forbidden");
         } else {
-            assert_error(&reply, StatusCode::NOT_IMPLEMENTED, "not_implemented");
+            assert_ne!(reply.status, StatusCode::FORBIDDEN, "{method} {path}");
         }
     }
 }