fix(sync): hold a drained cursor a minute back so late commits arrive

A page's watermark is its last row's stamp, and a long import stamps its rows before it commits them: a quick write committing in between carried the watermark past them, and the keyset never returned them. A caught-up page now hands out watermarks at most a minute before serverNow in every row domain, as start=now does, so the next pull reads that minute again. The mirror domain keeps its watermark.

src/app/api/sync/changes/route.ts

@@ -30,7 +30,11 @@
  *     server `id` (the client mirrors those by server id).
  *   - `hasMore` is true when ANY served domain still has rows past its
  *     page; the next `cursor` advances every domain that returned rows.
- *     When `hasMore` is false the client is caught up as of `serverNow`.
+ *     When `hasMore` is false the client is caught up as of `serverNow`,
+ *     and that page's cursor is held back to a minute before it in every
+ *     row domain (`holdBackDrainedCursor`): a row stamped in that minute
+ *     whose write commits after the pull still arrives on the next one, at
+ *     the cost of reading that minute twice.
  *   - `cursorExpired: true` when ANY domain watermark predates the
  *     tombstone-retention horizon — the client drops its cursor and does
  *     a clean initial sync (a deletion older than retention may have