S2S batch sync (POST /api/v1/sync)

[aram356]

Parent epic

#532

Description

Implement the server-to-server batch sync endpoint for partners to bulk-write their UIDs against a list of EC hashes.

Scope: ec/sync_batch.rs, router update

Acceptance criteria

• Missing or invalid Authorization: Bearer → 401. Auth uses index-based lookup via find_by_api_key_hash() with constant-time hash verification.
• Auth KV lookup failure → 503 Service Unavailable.
• API-key rate limit exceeded → 429 with { "error": "rate_limit_exceeded" }.
• More than 1000 mappings → 400.
• Per-mapping rejections: invalid_ec_hash, ec_hash_not_found, consent_withdrawn, kv_unavailable.
• KV write failure aborts remaining mappings with kv_unavailable; partial results as 207.
• All accepted → 200. Any rejection → 207.
• kv.upsert_partner_id() idempotent: duplicate timestamp counted as accepted.
• Rate counter key: batch:{partner_id}, 1-minute window.
• Unit tests cover status code selection, all rejection reasons, API-key rate limit.

Spec ref

docs/internal/ssc_technical_spec.md §9