C API v2, v1 data migration 015, v1 removal (DEV-1150 part 3c)

[adamski]

Puts the v2 engine behind the C API, migrates v1 local data, and removes v1. This is the C API that freezes as ABI 1.0 (library 0.7.0 in 3d).

This branch includes #52 (hardening). Merge #52 first, and this diff shrinks to the 61 commits after it.

What changes

• Registry and C API v2. The header is generated (include/replicant.h) and checked against the build. The C++ wrapper is include/replicant.hpp.
  • Configs and states are versioned by struct_size. Callback typedefs and constants carry the Replicant prefix.
  • Every exported function is wrapped in catch_unwind.
• Secrets never cross the API. load_credentials and store_credentials are gone.
  • enroll_claim stores the credentials and returns only the user id. clear signs out.
  • "Signed in" is the state and halt reason plus get_user_id.
• Credential halts. Every credential halt rechecks the stored credentials every 3 s. Signing out from any of them gives NotEnrolled.
  • create reads the stored credentials before it returns, so the first get_state is correct.
  • Credentials that are missing or can't be decrypted read as signed out. They no longer retry forever.
• Migration 015. Moves v1 local data to v2 without silent loss.
  • Unsent work that can't be migrated is kept aside as a recovered copy.
  • The v1 file is backed up once and never overwritten. A restored backup gets a fresh one.
• The library knows nothing about content.
  • Titles come only from ReplicantConfig.title_pointer, a JSON Pointer the app sets. With none set, there are no titles.
  • author_name is gone; documents carry owner_id and author_id.
  • Full-text search stays and gives no special weight to any key.
• JSON contract. The header documents every key of every JSON result.
  • A document's own id is id; other records refer to it as doc_id. The owner is owner_id.
  • Timestamps are RFC 3339 UTC.
• v1 removed. The CHANGELOG lists the removed and renamed 0.6 calls, error codes and JSON keys.
• SQLite. The static library exports its bundled SQLite 3.46.0. Code in the same binary must use it, and it is not part of the ABI (README).

Breaking for consumers

This is a new ABI (1.0). Entonal moves to it in Plan 4. Hosts must:

• pass the email in the config, needed for 0.6 credentials;
• set title_pointer;
• read owner_id instead of user_id.

Verification

• Tests: lib 614, also 4× with 16 threads. ffi_tests 45, ffi_lifecycle_tests 5, wire_contract_tests 15. v2_smoke compiles.
• Clippy shows only the 2 baseline warnings. fmt is clean.
• The header compiles as strict C11 under clang and gcc-14.
• The wrapper compiles with -Werror as C++17 and C++20 under clang++ and g++-14.
• A C probe linked against the static library passes 44/44.
• Reviews: final 3c review, two fix rounds with re-reviews, an ABI freeze review (freeze-ready), and a re-review of the pre-freeze round. All clean or fixed. Each fix has a test that fails when the fix is reverted.

Follow-ups: replicant-sync/replicant-server#12 (boundary cleanup); 3d (interop, release link check per platform, 0.7.0 release).