Wave 4 (partial): live-sync harness + Library screenshots; fix authors null decode

Both wave-4 workers hit the 5h session limit ~11 minutes in and were then lost
to a sprite suspend. This commit preserves the work that landed before that,
independently verified green (assembleDebug + testDebugUnitTest, 94 tests).

F1-livesync:
- LiveSyncTest + server/live-sync-test.sh: end-to-end exercise against a real
  PocketBase (auth, push with client ids, pull, tombstones, cover round-trip).
  Gated behind LIVE_SYNC=1 so the normal test task stays green with no server.
- Fix: BookDto.authors must be nullable. PocketBase serializes an unset `json`
  field as literal null (unlike text/number, which come back ""/0), so decoding
  any real response with empty authors threw. Found by the live test; no fake
  had ever reproduced it.
- Fix: cover upload derived its media type from the filename instead of
  hardcoding image/jpeg.

F2-release:
- ScreenFixtures + LibraryScreenPaparazziTest: library populated and empty,
  light and dark (4 PNGs).

Still owed by wave 4: screenshots for the other five screens, release keystore
+ signed APK, top-level README.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016mTs3kQXQsQwonXpEq7aEw

server/live-sync-test.sh

@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+#
+# live-sync-test.sh — runs LiveSyncTest against a REAL PocketBase.
+#
+# This is NOT part of `tasks/gw testDebugUnitTest` (that must stay green on
+# machines with no PocketBase running). LiveSyncTest gates itself behind the
+# LIVE_SYNC env var via org.junit.Assume, so invoking the normal test task
+# without this script just reports it SKIPPED.
+#
+# Usage:
+#   server/live-sync-test.sh
+#   PB_URL=http://127.0.0.1:8090 server/live-sync-test.sh
+#
+# Creates a throwaway app user (idempotent -- ignores "already exists") via
+# create-user.sh, then runs only LiveSyncTest with LIVE_SYNC=1 and the
+# matching creds exported as environment variables. The forked Gradle test
+# JVM inherits the environment of the process that launches it, which is how
+# these reach the test without touching app/app/build.gradle.kts (owned by
+# another worker this wave).
+
+set -u -o pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+
+PB_URL="${PB_URL:-http://127.0.0.1:8090}"
+PB_URL="${PB_URL%/}"
+LIVE_EMAIL="${LIVE_SYNC_EMAIL:-livetest@example.com}"
+LIVE_PASSWORD="${LIVE_SYNC_PASSWORD:-livetest-passw0rd-1}"
+
+log()  { printf '%s\n' "$*" >&2; }
+ok()   { printf '\033[32m✓\033[0m %s\n' "$*" >&2; }
+fail() { printf '\033[31m✗ ERROR:\033[0m %s\n' "$*" >&2; exit 1; }
+
+command -v curl >/dev/null 2>&1 || fail "curl is required but not installed."
+
+if ! curl -sf -o /dev/null --connect-timeout 5 "$PB_URL/api/health"; then
+  fail "Cannot reach $PB_URL/api/health -- is PocketBase running? (sprite-env services restart pocketbase)"
+fi
+
+log "Ensuring throwaway test user exists: $LIVE_EMAIL"
+CREATE_OUTPUT="$(PB_URL="$PB_URL" "$SCRIPT_DIR/create-user.sh" "$LIVE_EMAIL" "$LIVE_PASSWORD" "Live Sync Test" 2>&1)"
+if echo "$CREATE_OUTPUT" | grep -qi "not_unique\|already in use\|Created user"; then
+  ok "Test user ready"
+else
+  log "$CREATE_OUTPUT"
+  fail "Could not create or confirm the throwaway test user."
+fi
+
+export LIVE_SYNC=1
+export LIVE_SYNC_BASE_URL="$PB_URL"
+export LIVE_SYNC_EMAIL="$LIVE_EMAIL"
+export LIVE_SYNC_PASSWORD="$LIVE_PASSWORD"
+
+log "Running LiveSyncTest against $PB_URL as $LIVE_EMAIL"
+"$REPO_ROOT/tasks/gw" testDebugUnitTest --tests "org.modg.bookshelf.livesync.LiveSyncTest" --rerun