feat: ship loose-offline dbsync (validate, agent push, LWW audit)

Add UUID/FK channel checks, agent whitelist/push APIs, bindings, super-admin LWW audit with rollback, reconcile rate limits, and sync docs. Default customers stay opt-in; company conflict UI is removed.

Co-authored-by: Cursor <cursoragent@cursor.com>

platform/internal/dbsync/push_test.go

@@ -0,0 +1,46 @@
+package dbsync
+
+import "testing"
+
+func TestNormalizePushPayloadInsert(t *testing.T) {
+	op, payload, pk, err := normalizePushPayload(PushItem{
+		Op:    "insert",
+		RowPK: "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee",
+		Row: map[string]any{
+			"id":   "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee",
+			"name": "x",
+		},
+	}, "id")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if op != "upsert" || pk == "" || payload == "" {
+		t.Fatalf("got op=%s pk=%s payload=%s", op, pk, payload)
+	}
+}
+
+func TestNormalizePushPayloadDelete(t *testing.T) {
+	op, payload, pk, err := normalizePushPayload(PushItem{
+		Op:    "delete",
+		RowPK: "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee",
+	}, "id")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if op != "delete" || pk == "" || payload == "" {
+		t.Fatalf("got op=%s pk=%s payload=%s", op, pk, payload)
+	}
+}
+
+func TestTableInChannel(t *testing.T) {
+	ch := &Channel{
+		Local:  Endpoint{Tables: []string{"orders"}},
+		Remote: Endpoint{Tables: []string{"orders"}},
+	}
+	if !tableInChannel(ch, "orders") {
+		t.Fatal("expected in")
+	}
+	if tableInChannel(ch, "other") {
+		t.Fatal("expected out")
+	}
+}