Add KeepOrg sync server: accounts, nested groups, versioned KDBX sync

Why: collaborative KeePass use needs one arbiter of "who wrote last" that
never sees a master password, plus access control that follows an org chart.

What: stdlib-only Go server. Metadata is a single JSON document with one
writer and atomic commit; KDBX payloads are versioned blobs on disk. Access
comes from a group tree where a grant on a group reaches every member below
it. Login is password+TOTP, invite links, or OIDC through a browser-approved
device flow. Pushes carry If-Match and are arbitrated by a per-database merge
strategy (server-wins by default). Updates are pushed to clients over SSE.

Proved: go test ./internal/... covers RFC 6238 vectors, ACL inheritance and
isolation, store rollback, blob pruning, every push verdict, and an
end-to-end HTTP pass over login, conflict, force, read-only grants, invite
redemption, TOTP enrolment, device login and the event stream.

CLAUDE.md

@@ -0,0 +1,27 @@
+# General rules
+
+Be absolutely frugal about spending remaining resources. Default to short, direct answers. Drop the opening pleasantries and the wrap-up summary. Lead with the answer, add detail only if it's needed, and stop when you're done.
+
+# Naming and versioning
+
+Applications shall use `cc.tiredsysadmin.<operating_system>.<application>` namespace for their unique identifiers. Versioning is done automatically each change according to semantic versioning policy. Track application versions of each platform accordingly (Android, macOS, Linux, BSD, Windows).
+
+# Tools and building
+
+Use Makefile as an entrypoint for building and publishing applications. Each target is atomic, construct dependencies.
+
+For macOS versions always produce a DMG with a symlink to `/Applications` folder.
+
+For Linux versions always produce a boilerplate for building .deb packages, also track changelog.
+
+# Documentation
+
+Write developer handover documentation explaining architecture and decisions.
+
+# Publishing
+
+Android applications shall be published to a private F-Droid repository at rcmd@garage.rcmd.space:/var/lib/fdroid/unsigned, and the application metadata must be published at rcmd@garage.rcmd.space:/var/lib/fdroid/metadata. Publishing is always a manual action, never automatic.
+
+Android artifact naming scheme for publishing to unsigned directory is always `<application_id>_<version_code>.apk`
+
+MacOS, Linux, and Windows versions keep builds locally.