rename: the server is Inkwell — package, env vars, image, compose, export marker

Step 2 of milestone 481. The operator chose a full rename (Scribe note 5071), so
this goes past the display strings into the identities:

- src/thoughtsync → src/inkwell; every import, the Dockerfile and both compose
  commands, alembic env, pyproject
- THOUGHTSYNC_* → INKWELL_* (database URL, secret key, log level, tag/port/bind)
- container data dir /var/thoughtsync → /var/inkwell
- image git.fabledsword.com/bvandeusen/inkwell; Postgres user/db default inkwell;
  CI's integration service follows
- the files the image serves are inkwell.*. fetch-clients.sh still fetches the
  thoughtsync-named release assets, because the lanes that publish them are
  renamed in steps 3 and 4
- exports are written with app "inkwell"

Two deliberate exceptions, both because data rides on them:

- compose volumes are now named explicitly and overridable (INKWELL_DB_VOLUME,
  INKWELL_DATA_VOLUME), so a deployment installed as ThoughtSync points at the
  volumes and DB identity it already has. .env.example says exactly what to set
- import still accepts app "thoughtsync", because exports written before the
  rename are backups. Tested both ways

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/test_proxy.py

@@ -4,8 +4,8 @@ The whole security property is "a caller cannot forge their own address", and it
 on counting in from the RIGHT of the header rather than the left. These are the cases
 that tell the two apart — pure functions, no request context, no database.
 """
-from thoughtsync.proxy import forwarded_for, trusted_entry
-from thoughtsync.settings import live
+from inkwell.proxy import forwarded_for, trusted_entry
+from inkwell.settings import live
 
 PEER = "10.0.0.1"  # the socket address: our own proxy, or the caller when unproxied