feat(api): offline-first sync layer

Implements the stubbed /sync endpoints:
- GET /sync/changes — delta pull (likes, plays, changed playlists with
  their track ids, changed catalogue tracks) over the half-open window
  (since, cursor]; the cursor is the DB clock, so it's immune to app/DB
  skew.
- POST /sync/push — idempotent append of client like/play events
  (ON CONFLICT DO NOTHING by client-supplied id); events for tracks the
  server doesn't have are skipped (graceful degradation).

Adds a server-ingestion column `synced_at` to the likes + play_history
event logs (migration) as the delta ordering key, so an event pushed
with an older event time still surfaces for other devices. Repos gain
list_since/add_event (likes, history), list_changed_since (playlists,
tracks) and playlist.track_ids; wired via SyncService in deps.

Also fixes test isolation exposed by the registry-backed /admin/sources
endpoint: test_sources_api clears the process-cached source registry,
and test_admin_api no longer hardcodes the environment name.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/test_sources_api.py

@@ -59,6 +59,13 @@ async def api(tmp_path: Path) -> AsyncIterator[AsyncClient]:
     os.environ["LOCAL_MEDIA_IMPORT_PATH"] = str(music)
     get_settings.cache_clear()
 
+    # The source registry is process-cached (lru_cache); another test hitting a
+    # registry-backed endpoint (e.g. /admin/sources) may have built it before
+    # LOCAL_MEDIA_IMPORT_PATH was set. Clear it so this test sees a fresh one.
+    from app.api.deps import get_source_registry
+
+    get_source_registry.cache_clear()
+
     import app.infrastructure.storage.provider as _storage_provider
 
     _storage_provider._storage = None
@@ -94,6 +101,7 @@ async def api(tmp_path: Path) -> AsyncIterator[AsyncClient]:
         os.environ.pop("MEDIA_PATH", None)
         os.environ.pop("LOCAL_MEDIA_IMPORT_PATH", None)
         get_settings.cache_clear()
+        get_source_registry.cache_clear()
 
 
 async def _login(api: AsyncClient) -> str: