feat(api): sync réel — outbox POST /sync/ops idempotente + snapshot GET /sync/permissions (owner V1)

- operations.operation_id/ref_id BIGINT (= id client pending_operations), UNIQUE(device_id, operation_id) idempotente ; migration 000004 corrigée + test
- service/sync.go : ApplyBatch séquentiel (no-op si déjà traitée ; create déjà présent / update/move sur ressource absente / delete absent = no-op) ;
  arrêt à la première erreur non-idempotente (NAME_CONFLICT, NOT_FOUND, INVALID_REQUEST) + trace après succès ; ops share/share_link accusées sans état (V1)
- handlers/sync.go : POST /sync/ops → {applied, failed|null} ; GET /sync/permissions?after= → snapshot delta (effectiveAccess owner, cachedAt ms)
- snapshot : repo.ListOwned (delta updated_at en ms, trié) ; index partiel racine (owner_id, name) WHERE parent_id IS NULL
- GET /files sans folderId = racine uniquement (convention useFiles(undefined)) ; tests files_test corrigés (codes d'erreur imbriqués, tailles)
- fix dbtest : ping la connexion maintenance (création de la DB cible possible) — les tests handlers/repo tournent enfin contre PG réel
- tests handlers end-to-end : batch appliqué + retry idempotent, arrêt sur NAME_CONFLICT, delete idempotent, snapshot + delta

backend/handlers/sync.go

@@ -1,9 +1,54 @@
 package handlers
 
 import (
+	"net/http"
+
 	"github.com/gin-gonic/gin"
+
 	"github.com/vaultdrop/backend/pkg/api"
+	"github.com/vaultdrop/backend/service"
 )
 
-func SyncOpsPush(c *gin.Context)        { api.NotImplemented(c) }
-func SyncPermissionsGet(c *gin.Context) { api.NotImplemented(c) }
+type syncOpsRequest struct {
+	Operations []service.SyncOperation `json:"operations"`
+}
+
+func SyncOpsPush(c *gin.Context) {
+	if Store == nil {
+		api.Error(c, http.StatusServiceUnavailable, "SERVICE_UNAVAILABLE", "backend not initialized")
+		return
+	}
+	deviceID := c.GetString(DeviceIDKey)
+
+	var req syncOpsRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		api.Error(c, http.StatusBadRequest, "INVALID_REQUEST", "invalid JSON body")
+		return
+	}
+
+	result, err := Store.ApplyBatch(deviceID, req.Operations)
+	if err != nil {
+		writeError(c, err)
+		return
+	}
+	api.OK(c, result)
+}
+
+func SyncPermissionsGet(c *gin.Context) {
+	if Store == nil {
+		api.Error(c, http.StatusServiceUnavailable, "SERVICE_UNAVAILABLE", "backend not initialized")
+		return
+	}
+	deviceID := c.GetString(DeviceIDKey)
+	after := c.Query("after")
+	var afterMs int64
+	if after != "" {
+		afterMs = int64(intParam(after, 0))
+	}
+	perms, err := Store.Snapshot(deviceID, afterMs)
+	if err != nil {
+		writeError(c, err)
+		return
+	}
+	api.OK(c, perms)
+}