fix(research): re-anchor the export sanitizer after aw-server-rust#677 streaming exports - #1449

…xport

aw-server-rust#721 moved JSON export serialization onto a background
thread that runs after the 200 headers, so the sanitizer anchor from
#1449 no longer exists (the research legs failed closed on it), and a
sanitizer failure there could no longer become an error response.
aw-server-rust#722 added a raw-event CSV export that no sanitizer covers.

In Research Edition builds (approved by Erik, options A + B):
- A: BucketsExportRocket::new exports, sanitizes and re-spools to a
  tempfile before any headers, so a refused export is still a
  fail-closed 409; respond_to only streams the sanitized spool.
- B: BucketEventsCsvRocket::new returns 403 "CSV export is disabled in
  Research Edition".

The patcher checks every anchor (export struct, export impl, CSV, mod.rs)
for exactly one match before writing anything, so a missing or duplicated
anchor fails the build without leaving a half-patched tree. Tempfiles are
unnamed (tempfile::tempfile), so they are removed on every path.

Verified on a patched aw-server-rust e7c5439 release build: a clean
currentwindow bucket exports with 200 and the hostname rewritten to
research-participant (the real one appears nowhere), an event with a
url makes /api/0/export and /api/0/buckets/<id>/export return 409, and
/api/0/buckets/<id>/export/csv returns 403.

)

* build(deps): bump aw-core and aw-server-rust for the parity fixes

aw-core 33c8528 -> 99cb7ac (#161, #167, #168, #169, #159) and aw-server-rust
c3baa9c -> e7c5439 (#744, #748, #749, #750, #753). 433 known failures now
pass, none are new.

The remaining 532 are re-attributed with attribute.py from runs at the
new pins: base, aw-core#165 alone, aw-core#166 alone, and both (with two
open fixes, each leave-one-out run is the other fix alone). 81 are fixed
by those PRs (CORE_165: 22, CORE_166: 59); the other 451 are the #1466
output shapes (SHAPE) and 1 ms timestamp resolution (PRECISION).

* build(deps): bump aw-core to 7b24386 and aw-tauri to ec46d16

- aw-core 99cb7ac -> 7b24386: #171 fixes the aw-core test failure that broke
  the Qt legs (#159 + #169 disagreed on iter_events order), plus #166
  and #170.
- aw-tauri a2f72df -> ec46d16: ActivityWatch/aw-tauri#271 locks
  aw-server-rust at e7c5439, matching the release submodule, which
  scripts/check_tauri_server.py requires (the Tauri legs failed on it).

#166 landing fixes the 59 CORE_166 known failures. Re-attributed from
runs at the new pins (base and aw-core#165): 473 remain, 22 CORE_165,
the rest SHAPE (#1466) and PRECISION.

* build(deps): bump aw-core to d6ec34c (aw-core#165)

The 22 CORE_165 known failures pass now and none are new. 451 remain,
all SHAPE (#1466) and PRECISION: no open parity fixes left.

* fix(research): sanitize JSON exports before headers and disable CSV export

aw-server-rust#721 moved JSON export serialization onto a background
thread that runs after the 200 headers, so the sanitizer anchor from
#1449 no longer exists (the research legs failed closed on it), and a
sanitizer failure there could no longer become an error response.
aw-server-rust#722 added a raw-event CSV export that no sanitizer covers.

In Research Edition builds (approved by Erik, options A + B):
- A: BucketsExportRocket::new exports, sanitizes and re-spools to a
  tempfile before any headers, so a refused export is still a
  fail-closed 409; respond_to only streams the sanitized spool.
- B: BucketEventsCsvRocket::new returns 403 "CSV export is disabled in
  Research Edition".

The patcher checks every anchor (export struct, export impl, CSV, mod.rs)
for exactly one match before writing anything, so a missing or duplicated
anchor fails the build without leaving a half-patched tree. Tempfiles are
unnamed (tempfile::tempfile), so they are removed on every path.

Verified on a patched aw-server-rust e7c5439 release build: a clean
currentwindow bucket exports with 200 and the hostname rewritten to
research-participant (the real one appears nowhere), an event with a
url makes /api/0/export and /api/0/buckets/<id>/export return 409, and
/api/0/buckets/<id>/export/csv returns 403.

* fix(research): assert the research export behaviour in upstream's tests

The research legs run aw-server-rust's full test suite against the patched
server, and two tests new since the bump assert the standard behaviour:
aw-server's CSV export test (now 403 by design) and aw-client-rust's
export/import round trip (#727; research exports rewrite the bucket id and
hostname). The patcher now rewrites both in research builds to assert the
research behaviour instead: CSV export is 403 for existing and missing
buckets, and exports contain no real hostname or bucket id. Same
exactly-one-anchor, all-or-nothing rules as the server edits.

`cargo test --no-fail-fast` on a patched aw-server-rust e7c5439: all pass.