Sync hardening backlog: per-file watcher suppression, write mutex, API polish

[sergi039]

Problems (from 2026-06-10 code review, deferred)

1. Global suppression refcount (`watcher.ts:13-52`): writeback on board A queues genuine external edits to board B; 500ms replay is timing-coupled to chokidar's 300ms `awaitWriteFinish`. Should be per-file suppression + per-file write mutex (reconciler stamp and writeback use different temp names but rename to the same target — last writer wins).
2. PATCH /api/cards/:id swallows writeback failures (routes/cards.ts:271-305) — returns 200 while .md diverges; the `move` route surfaces `_writeBackWarning`, PATCH should too.
3. 500 responses leak internals (`String(err)` with absolute paths) in cards.ts:157,416, boards.ts:249, inbox.ts:152.
4. Column mutations (add/reorder/rename/delete) don't broadcast WS events (routes/boards.ts:444-560) — other tabs stay stale.
5. TableView toggle-done hardcodes `Done`/`Backlog` column names (TableView.tsx:128-139) — 400 on boards without those names, error only console-logged.
6. Client-side filter re-implements filter-engine and diverges (`has:comments` filters everything out; App.tsx:324-442).
7. writeBackDoneState ±5-line fuzzy fallback can toggle the wrong task when titles duplicate and kb:id is missing (writeback.ts:99-107) — refuse fuzzy match when card has no kb:id.
8. Config cached forever (config.ts:72-85) — fixing `vaultRoot` in config.boards.json requires restart; consider watching the config file or exposing reload.

[sergi039]

Note: apps/api tsc --noEmit has 8 pre-existing type errors on codex/kanban-mcp-routing (ingest result union in routes/cards.ts:147-150 and routes/inbox.ts:137-138; WsEvent typing in routes/reminders.ts:105-108 — the latter is item-style M3 from the review). Tests pass; tsx runtime is unaffected, but these should be cleaned up with this backlog batch.

[sergi039]

The tsc-cleanup item is done (commit 913a8a0 — tsc --noEmit now clean in apps/api). Remaining items in this backlog: per-file watcher suppression/write mutex, PATCH writeback warnings, error-detail hygiene in 500s, column-mutation WS broadcasts, TableView hardcoded Done/Backlog, client/server filter divergence, fuzzy-match guard, config hot-reload.