feat(sync): Rebuild from iCloud — self-serve full resync (#300)

[yicheng47]

Closes #300.

What

A Resync action in Library Sync settings that discards the local materialized view of synced data and reconstructs it from the peer snapshots and event logs in the shared folder. One-way pull — nothing in iCloud is deleted or rewritten beyond the device's own log/snapshot/manifest. Escape hatch for diverged/stuck sync (#298).

How

sync_rebuild runs, single-flight and serialized:

1. Pre-wipe fold tick — drains the outbox and applies any own events not yet replayed locally, so tombstones for recent deletes exist before anything is snapshotted.
2. Sealed bootstrap publish — under the outbox seal, re-applies the full own log (the self watermark can sit past a failed event, so it isn't trusted as proof of application), failing closed on any apply error, then publishes the bootstrap snapshot. Every local row that ever reached SQL is durable in iCloud before anything is deleted.
3. Rebuild marker in the local-only settings table, then one wipe transaction clearing the eight synced tables and every _replay_state watermark, under the tick lock.
4. Full replay via tick_with_progress (covers cover re-ingest and drives the existing sidebar progress chip), marker cleared only on a complete, un-cancelled pass.

Interrupted/cancelled rebuilds resume on next launch from both engine-boot sites; retries and sync_enable are marker-aware so a wiped/partial DB can never be published over the recovery snapshot. Cancellation uses a monotonic generation captured inside the serialized section, with gates before every destructive step.

Spec deviation: translations is preserved rather than wiped — no replay source exists (snapshots don't carry it; its events are no-ops since #263), and the table is already dropped on dev DBs stamped by a since-deleted migration 14. Spec should be updated nine → eight tables.

Testing

• ~20 new backend unit tests covering: publish-before-wipe survival, local-table/tombstone preservation, watermark clearing, healthy-library convergence with cover re-ingest, interrupted-rebuild resume, retry/enable marker-awareness, unapplied-delete tombstone materialization, watermark-hole abort, fail-closed sealed publish, single-flight concurrency, and the full cancellation matrix.
• Full suite: 282 passed / 0 failed; clippy clean; tsc + vite build clean.
• Reviewed through five working-tree review rounds (crew reviewer); final verdict clean.
• Smoke-tested on the dev install against the real iCloud library.

🤖 Generated with Claude Code