feat: close the two remaining ADR 0023 / Art. 20 follow-ups

[Musiker15]

Closes the two items the earlier backlog left deliberately open.

1. Create a card from a template while offline

Applying a card template was a POST chain where each step needed the id the previous response returned, so nothing could be queued and offline the whole action aborted with no UI effect.

The chain now mints every id on the client up front (ADR 0023), which makes the steps independent and queueable. flushOutbox replays oldest-first, so a child never reaches the server before the row it hangs off.

Two create endpoints gain the optional id + idempotent-replay contract the card and comment endpoints already had:

• POST /api/cards/[id]/checklists
• POST /api/checklists/[id]/items

Both authorize a replay against the board the existing row currently lives on, not the one named in the request, which is what stops a caller probing or hijacking a row that has since moved.

One ordering hazard is handled explicitly: once any link of the chain is queued, the rest is queued too, even if the browser still reports itself online. queuedFetch's per-card ordering guard cannot cover this, because the card create posts to /api/columns/<id>/cards and shares no ordering key with its children. Without it, a transient failure on the card POST would queue it while the checklist POST fired directly and 404'd.

2. Account-wide bulk export, decrypted

Portability existed per board only and required opening each board. There is now one action on the account page that exports every board in every workspace as readable JSON.

It has to live on the client: the server holds only ciphertext and no keys, so GET /api/me/export returns the tree still encrypted. src/lib/export/account-export.ts walks the hierarchy the user already holds (sealed WorkspaceKey to wrapped BoardKey to content) and decrypts locally. One request, then no further network I/O, since the per-board exporter fetches per card and would otherwise mean thousands of requests across an account.

Three gaps in the server dump had to be closed first, which also make the plain Art. 15 export more complete:

• Card.parentId was not selected, so mind-map hierarchies were flattened.
• CardTemplate was not selected at all, so the exported templates section was always empty.
• Only the caller's own membership row was present, so assignees could not be remapped on re-import. Co-members now ship as {userId, email, role}, which is not new exposure: GET /api/workspaces/[wsId]/members already returns exactly that to any member.

A board whose key cannot be unwrapped is recorded under skipped with a reason rather than dropped, so a partial export never reads as complete.

Security notes

⚠️ Crypto-relevant. account-export.ts performs key unsealing and unwrapping client-side; tests/unit/account-export.test.ts exercises it with the real crypto rather than stubs, because the point of the feature is that the client can walk the hierarchy unaided.

Threat impact: the two new optional-id endpoints widen the input surface, mitigated by the same charset/length lockdown as the card route plus authorization against the existing row's current board. The export changes add co-member emails to a response that was already reachable via the members endpoint.

Verification

typecheck, lint, 330 unit tests and a production build pass. The coverage gate (repaired earlier today) stays green.

Not covered: an end-to-end click-through of the export button needs a seeded DB and an unlocked vault, so the UI section itself is only verified as far as the route compiling and the auth guard redirecting. The decrypt pipeline underneath it has full real-crypto coverage.