Make the /api/sync category parity test read the real getSupportedCategories

[atomantic]

Summary

• The /api/sync category "parity with getSupportedCategories" test mocked that export to return [] and then iterated a hardcoded copy of the route's own Zod enum — it compared the route to itself. The Optional cross-machine resumable story-builder sessions #730 regression it exists to catch (a category registered in dataSync.CATEGORIES but forgotten in categoryParam, which 400s before the handler runs) produced a green suite.
• The service mock now delegates getSupportedCategories to the real module via vi.importActual. The three I/O entry points stay stubbed, so the route test still never touches a store.
• categoryParam is exported from server/routes/dataSync.js so the test compares the two lists symmetrically rather than re-typing one. That also covers the previously unguarded direction: an enum entry the service retired, which reaches a 404 at the service.
• Per-category cases are generated from the real list, and the assertion moves from not.toBe(400) — which a 500 from a broken handler also satisfies — to the actual contract (200 plus the exact getChecksum arguments).
• The apply verb parses the same enum as the reads, so it gets no second per-category sweep; its existing case is tightened to assert the exact applyRemote arguments instead of only that it was called.

Rolled in

Pulling the real export loads the whole dataSync service graph, so the settings.js mock spreads the real module instead of listing one export — a hand-listed stub breaks again the next time that graph grows an import. The same graph is why privacyNeverFederates.test.js gets an explicit timeout: its lazy import('../dataSync.js') runs inside the test body and was already flaking against the default 10s cap.

Test plan

• cd server && npm test — 37715 passing. The two failures in services/sprites/atlas.test.js are pre-existing: verified reproducing on a clean origin/main checkout outside the worktree (7 failures there, 6 on this branch), and untouched by this diff.
• Bypass probes, run against the fixed test and then reverted:
  • Added a category to CATEGORIES in server/services/dataSync.js without adding it to categoryParam — 2 failures (matches the service category list exactly and the generated checksum case for it). The old test passed this.
  • Added a category to categoryParam that the service does not support — matches the service category list exactly fails. Previously unguarded.
• Reviewed locally with agy --effort medium; its two substantive findings (use a symmetric list assertion, drop the duplicated apply sweep) are applied above.

Closes #5705