Sync/merge hardening (never lose data on a bad or down server):
- apply_remote_inner now runs the whole merge in ONE transaction —
  all-or-nothing, so a failure partway can't leave a half-merged vault.
- per-record apply is best-effort: a record that won't decrypt (a corrupt
  or hostile blob from a broken server) is logged + skipped instead of
  aborting the whole sync. One poison record can't block every other one.
- connect_timeout (10s) so an unreachable server fails fast, not after 60s.
- new test: corrupt_record_is_skipped_without_aborting_the_batch.

UX:
- background sync interval is now user-configurable (Settings -> Cloud Sync:
  1/2/5/10/15/30 min, default 5). Only gates the periodic pull; own edits
  still push a few seconds after you stop.
- Profile panel shows an "auto-sync is on -- your changes are saved
  automatically" notice with an inline on/off toggle, synced with Settings.

Cleanup: drop dead code (ApiError.server_version, mirror::local_mtime) — 0 warnings.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>