Add KeepOrg sync server: accounts, nested groups, versioned KDBX sync

Why: collaborative KeePass use needs one arbiter of "who wrote last" that
never sees a master password, plus access control that follows an org chart.

What: stdlib-only Go server. Metadata is a single JSON document with one
writer and atomic commit; KDBX payloads are versioned blobs on disk. Access
comes from a group tree where a grant on a group reaches every member below
it. Login is password+TOTP, invite links, or OIDC through a browser-approved
device flow. Pushes carry If-Match and are arbitrated by a per-database merge
strategy (server-wins by default). Updates are pushed to clients over SSE.

Proved: go test ./internal/... covers RFC 6238 vectors, ACL inheritance and
isolation, store rollback, blob pruning, every push verdict, and an
end-to-end HTTP pass over login, conflict, force, read-only grants, invite
redemption, TOTP enrolment, device login and the event stream.

versions.mk

@@ -0,0 +1,18 @@
+# Single source of truth for all platform versions (semver).
+# Bump with: make bump PLATFORM=<server|linux|macos|windows|bsd|android> PART=<major|minor|patch>
+VERSION_SERVER   := 0.1.0
+VERSION_LINUX    := 0.1.0
+VERSION_MACOS    := 0.1.0
+VERSION_WINDOWS  := 0.1.0
+VERSION_BSD      := 0.1.0
+VERSION_ANDROID  := 0.1.0
+# Monotonic Android versionCode, never decreases.
+ANDROID_VERSION_CODE := 1
+
+# Reverse-DNS application identifiers.
+APPID_ANDROID := cc.tiredsysadmin.android.keeporg
+APPID_MACOS   := cc.tiredsysadmin.macos.keeporg
+APPID_LINUX   := cc.tiredsysadmin.linux.keeporg
+APPID_WINDOWS := cc.tiredsysadmin.windows.keeporg
+APPID_BSD     := cc.tiredsysadmin.bsd.keeporg
+APPID_SERVER  := cc.tiredsysadmin.linux.keeporgd