fix(sync): preserve omitted targets when any document is refused

[albertovincenzi]

Problem

The target sync endpoint kept processing after a document was refused and then always entered its destructive reap phase. A partially invalid desired-state list could therefore return ok: false while deleting an existing one-node graph omitted from the request.

Fix

• run the reap phase only when every submitted document was accepted;
• keep successful declarations applied, but treat a refusal as proof that the submitted set is not safe deletion authority;
• add a broker-backed regression that declares two targets, submits one valid plus one invalid document, and verifies the omitted target survives.

Review notes for Alice

This PR intentionally changes only the boundary between declaration and deletion. It does not attempt a distributed transaction across the valid declarations or broker-backed store. The safety invariant is narrower and explicit: validation/provisioning refusal means zero reap operations.

Verification

• cargo test --workspace
• cargo clippy -p gate-server --all-targets -- -D warnings
• cargo fmt --all -- --check

The end-to-end regression follows the existing live-test convention and requires GATE_TEST_QUEEN_URL.

[albertovincenzi]

Closing as a duplicate of #29.

The two branches make a byte-identical change to do_sync — diff of the two declare.rs files shows only a comment difference — and they conflict with each other in that file, so only one can land.

#29 is the one to keep, because #46 is stacked on it. The stronger regression from this PR has been ported there: #29's test now declares two targets, submits one valid document plus one broken one, and asserts that the omitted target survives, which is the property neither test covered before.

https://claude.ai/code/session_012K8u7BEJyd6nDNMCQAgH3z