Old app: move guests to accounts, finish syncing, then stop writes

[paccloud]

What to build

This slice prepares the current Vercel app for the switch (ADRs 0001 and 0002 in #122). Browser storage can't cross to the new address, so the last releases of the old app have to move data into accounts and then stop changes, in this order:

1. Move guests and finish syncing. A guest holding saved data is asked to sign in, and the existing adoption code moves their records into the account. Signed-in users are prompted to finish syncing any pending changes.
2. Make the app read-only. A release makes the old app itself read-only. It stops accepting new edits (saves, imports, deletes) but still pushes changes that are already pending, and it shows a banner explaining the move. It also offers "Save my unsent changes", which downloads any records still waiting to sync, or any guest records, as a file the new app's import accepts (Import custom yields from Excel/CSV in the browser #127). This is the way across for a device that stayed offline the whole time, which the server can't see.
3. Freeze the API. After a waiting period for devices to come online, a single setting puts the old API into read-only mode. Every write endpoint answers with a clear error, and reads keep working.

Both backends (api/ and server/) must honour the API setting.

Acceptance criteria

• A guest with saved records sees a prompt to sign in, and signing in moves their records into the account
• Signed-in users with pending changes see a prompt, and the sync finishes before they leave
• With the app read-only, no new edit can be made in the browser, pending changes still sync, and a banner explains the move
• The read-only app offers "Save my unsent changes" whenever records are waiting to sync or held as a guest, and the file's format is documented for Import custom yields from Excel/CSV in the browser #127
• The service worker picks up the read-only release on the next load, so installed copies get it too
• With API read-only mode on, every write endpoint in api/ and server/ answers with a documented error, and tests cover each one
• With API read-only mode on, reads and the calculator still work, and the "Save my unsent changes" option stays available
• Both modes are off by default and each is turned on by one setting; the runbook sets the waiting period before the API freeze

Blocked by

None - can start immediately