feat(sync): read-only PHP endpoint serving the encrypted snapshot

Alternative to WebDAV, and the base for an Android client. The server never decrypts: it stores and serves opaque bytes, so a compromise yields ciphertext plus size and mtime.

GET only for now, with a strong ETag and If-None-Match; PUT answers 405 explicitly so a client fails loudly rather than believing it wrote. A bad token answers 404 like a missing snapshot, so an unauthenticated caller learns nothing. HTTPS is required - the bearer token rides a header on every call.

server-php/config.example.php

@@ -0,0 +1,17 @@
+<?php
+/**
+ * Copy to config.php and fill in. config.php is gitignored — it holds a secret.
+ */
+
+declare(strict_types=1);
+
+// Bearer token the clients send. Generate one, never reuse a password:
+//   php -r "echo bin2hex(random_bytes(32)), PHP_EOL;"
+// It authenticates the DEVICE, not the vault: it grants access to the
+// ciphertext only. The sync password (which decrypts it) never leaves the
+// clients and is never known to this server.
+const SYNC_TOKEN = 'PUT-A-64-HEX-TOKEN-HERE';
+
+// Where the snapshot lives. Keep it OUTSIDE the web root: served through this
+// script only, never fetchable as a static file.
+const SYNC_FILE = __DIR__ . '/../vault-data/vault-sync.json';