M2: replace shape-specific backend with generic KV doc store (firebase mirror)

Backend was endpoint-mapper (POST /api/campaigns ignores path id, etc). Adapter
translation layer brittle, untested, lost doc identity. Generic contract (Layer 2)
test caught 15 bugs immediately.

Rewrite to firebase-mirror KV model:
- server/db.js: docs table (path PK, parent, data JSON). getDoc/setDoc/updateDoc/
  deleteDoc/getCollection/batchWrite. parent = path prefix for collection queries.
- server/index.js: generic REST (GET/PUT/PATCH/DELETE /api/doc, GET /api/collection,
  POST /api/collection addDoc, POST /api/batch). WS subscribe by path (doc|collection),
  broadcast to doc subs at changed path + collection subs at parent path.
- src/storage/ws.js: thin passthrough adapter. norm() strips firebase prefix.
  initial value via REST (independent of WS connect), subsequent changes via WS.
- shared/turn.js kept (M4 use). server/handlers.js + server.test.js removed (logic
  now in App, backend is dumb KV).
- src/storage/contract.js: flush() bumped to 50ms (WS roundtrip > setTimeout(0)).

Layer 2 test (server/ws-contract.test.js): spins fresh backend per test, runs same
storage contract spec against createWsStorage. Catches adapter translation bugs
that firebase-mock Layer 1 tests cannot.

nanoid v5 ESM breaks jest CJS -> replaced with crypto.randomUUID (Node builtin).

Tests: 114 green (39 shared + 19 ws-contract + 56 frontend).

docs/DEVELOPMENT.md

@@ -14,11 +14,10 @@ TTRPG Initiative Tracker — fork with self-hosted backend. Monorepo via npm wor
   package.json          # workspaces root
   src/                  # React frontend (CRA, existing)
     App.js              # ~2935 lines, Firebase direct (M2 abstracts this)
-  server/               # Backend: Express + ws + better-sqlite3
-    index.js            # REST + WS bootstrap
-    db.js               # SQLite schema, row mappers
-    handlers.js         # action -> shared turn fn -> tx persist -> broadcast
-    server.test.js      # integration tests
+  server/               # Backend: generic KV doc store (firebase mirror)
+    index.js            # REST (doc/coll/batch) + WS bootstrap
+    db.js               # SQLite docs table, KV ops, broadcast
+    ws-contract.test.js # adapter vs live backend (Layer 2)
   shared/               # Pure logic, no I/O (client + server + tests import)
     turn.js             # turn-order state machine
     turn.characterization.test.js
@@ -67,7 +66,7 @@ Three commands:
 ```bash
 npm run test:all          # runs shared/ + server/ suites in sequence
 npm run shared:test       # turn logic only (shared/ folder)
-npm run server:test       # backend REST + combat flow (server/ folder)
+npm run server:test       # backend ws-contract (adapter vs live backend)
 ```
 
 What each runs: