Implement ecosystem contract v2: capabilities, shared ledgers, attachments

- GET /v1/capabilities and the extended sync entity allowlist (§0, §1).
- Shared ledgers (§7): ledgers, members and hashed one-time invite codes;
  X-Balance-Ledger selects the space on /v1/sync and /v1/attachments with
  its own records, change stream and cursor. Personal space keeps the v1
  tables and behaviour; the migration only adds tables.
- Attachments (§8): SHA-256, size and media type checks, blob files in
  BALANCE_ATTACHMENTS_DIR (default: attachments next to the database),
  garbage collection of unreferenced blobs with a grace period for fresh
  uploads, and ledger deletion removes its blobs.
- Tests for every new endpoint and error code; API, sync, data model,
  security, deployment and README docs updated.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

AGENTS.md

@@ -14,7 +14,8 @@
 Go — в `tests/fixtures/go_schema_v1.sql`. Оба файла не правь вручную.
 
 Основные Rust-модули: `src/main.rs`, `runtime.rs`, `config.rs`,
-`database.rs`, `auth.rs`, `server.rs`, `sync.rs`, `go_json.rs`.
+`database.rs`, `auth.rs`, `server.rs`, `sync.rs`, `go_json.rs`,
+`ledgers.rs`, `attachments.rs` (контракт v2, `docs/CONTRACT_V2.md`).
 Веб-клиент из `web/` встроен в Rust executable.
 
 Обнаруженные технологии/интеграции: SQLite, Docker.