feat(todo): the person's projects, sealed and synced, the Inbox made once (ADR 0033, D5, D6)

TodoPerson opens the person's own sync database in their folder,
halkyon_app's SyncService behind AppCompatibility, their key (TodoKeys,
Train's copied with Todo's own key IDs) and their projects, and closes
them in that order, the key last. A project is sealed for its row; a
readable, foreign or moved row shows locked, and a device without the
account's keys reads and writes nothing. The Inbox is the row under an
ID keyed by the account, so every device makes the same one and the
instance can't tell which it is; it can't be deleted. Settings shows
Sync's card first and the cog its dot while sync fails, as Learn's.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

docs/adr/0033-halkyon-todo.md

@@ -85,7 +85,11 @@ the rail, a wash of strawberry, settings grouped as theirs. What the screenshots
 - **D6 Four tables: `project`, `section`, `task`, `label`** (recommended, as Train keeps a
   workout and its series apart, D14): one row each, changed when edited, the last writer
   winning, every payload JSON with a `schemaVersion`, UUID v7 ids. Inbox is a project the
-  app makes once per person, marked so in its payload. A **sub-task** is a task naming its
+  app makes once per person, under a row ID keyed by the account (Train's D57,
+  `keyedRowId`), not marked in its payload (as built, 1 Nov): every device makes the
+  same row, so two making it offline write one, and the instance can tell neither
+  which row is the Inbox nor whose it is; a payload's mark would let a moved row
+  claim to be it. A **sub-task** is a task naming its
   parent. A task's payload: title, description, its project and section, its parent, its
   place among its siblings, a **date** (a day, or a day and a time with an optional
   duration, the time as the person's wall clock with its time zone), a **deadline** (a