fix(sync): hold a drained cursor a minute back so late commits arrive

A page's watermark is its last row's stamp, and a long import stamps its rows before it commits them: a quick write committing in between carried the watermark past them, and the keyset never returned them. A caught-up page now hands out watermarks at most a minute before serverNow in every row domain, as start=now does, so the next pull reads that minute again. The mirror domain keeps its watermark.

docs/api/openapi.yaml

@@ -50185,7 +50185,9 @@ components:
             - "null"
         hasMore:
           type: boolean
-          description: False once the client is caught up as of `serverNow`.
+          description: False once the client is caught up as of `serverNow`. The cursor of such a page sits at most a minute
+            before `serverNow` in each row domain, so the next pull reads rows changed in that last minute again (a
+            write still in flight may commit a row stamped there); upserts are idempotent.
         cursorExpired:
           type: boolean
           description: True when the supplied cursor predates tombstone retention, or was issued before the account's data was