M2: replace shape-specific backend with generic KV doc store (firebase mirror)

Backend was endpoint-mapper (POST /api/campaigns ignores path id, etc). Adapter
translation layer brittle, untested, lost doc identity. Generic contract (Layer 2)
test caught 15 bugs immediately.

Rewrite to firebase-mirror KV model:
- server/db.js: docs table (path PK, parent, data JSON). getDoc/setDoc/updateDoc/
  deleteDoc/getCollection/batchWrite. parent = path prefix for collection queries.
- server/index.js: generic REST (GET/PUT/PATCH/DELETE /api/doc, GET /api/collection,
  POST /api/collection addDoc, POST /api/batch). WS subscribe by path (doc|collection),
  broadcast to doc subs at changed path + collection subs at parent path.
- src/storage/ws.js: thin passthrough adapter. norm() strips firebase prefix.
  initial value via REST (independent of WS connect), subsequent changes via WS.
- shared/turn.js kept (M4 use). server/handlers.js + server.test.js removed (logic
  now in App, backend is dumb KV).
- src/storage/contract.js: flush() bumped to 50ms (WS roundtrip > setTimeout(0)).

Layer 2 test (server/ws-contract.test.js): spins fresh backend per test, runs same
storage contract spec against createWsStorage. Catches adapter translation bugs
that firebase-mock Layer 1 tests cannot.

nanoid v5 ESM breaks jest CJS -> replaced with crypto.randomUUID (Node builtin).

Tests: 114 green (39 shared + 19 ws-contract + 56 frontend).

server/ws-contract.test.js

@@ -0,0 +1,36 @@
+// Layer 2 test: exercise ws.js storage adapter against a LIVE backend.
+// Complements Layer 1 (App + firebase mock) which proves App call shape but
+// never touches ws.js. This catches translation bugs in the adapter.
+//
+// Runs the shared storage contract (same spec memory/firebase satisfy) against
+// createWsStorage pointed at an ephemeral backend instance. A FRESH backend is
+// spun up per test to guarantee isolation (backend has no reset endpoint yet).
+
+'use strict';
+
+const path = require('path');
+const os = require('os');
+const { createServer } = require('../server/index');
+const { createWsStorage } = require('../src/storage/ws');
+const { runStorageContract } = require('../src/storage/contract');
+
+let nextPort = 4000 + Math.floor(Math.random() * 999);
+
+// Factory: fresh backend (unique sqlite file) + storage pointed at it.
+// Disposing the storage closes the backend so each test is fully isolated.
+async function makeStorage() {
+  const port = nextPort++;
+  const dbPath = path.join(os.tmpdir(), `ws-contract-${port}-${Date.now()}.sqlite`);
+  const handle = createServer({ dbPath, port });
+  await new Promise((resolve, reject) => {
+    handle.server.on('error', reject);
+    handle.server.listen(port, resolve);
+  });
+  const baseUrl = `http://127.0.0.1:${port}`;
+  const wsUrl = `ws://127.0.0.1:${port}/ws`;
+  const storage = createWsStorage({ baseUrl, wsUrl });
+  storage.dispose = (done) => handle.close(done);
+  return storage;
+}
+
+runStorageContract('ws (live backend)', makeStorage);