Sync 3: pull endpoint GET /api/sync/changes (M8)

Delta pull for native clients: returns every note + label the caller owns
whose sync_revision advanced past ?since=<cursor>, ascending by revision,
paginated (?limit, default 500 / max 1000), with the next cursor +
has_more. since=0 is a full initial sync. Web app unaffected (new blueprint).

Notes and labels share one revision sequence, so the cursor is a single
watermark. _page_cursor() handles the two-stream paging: when either stream
fills its page, it advances only to the SMALLER of the two page boundaries
so nothing between the cursor and the next pull is skipped. Notes reuse
_serialize_notes (items/labels/attachments inline) + sync_revision +
purged_at (tombstone); labels carry name/color/purged_at/sync_revision.

Returns ALL of the owner's notes regardless of state (active/archived/
trash/purged) — a client mirrors everything. Registered sync blueprint.

Tests (DB-free): changes auth-guard; _parse_since / _clamp_limit
validation; _page_cursor across empty / drained / one-full / both-full.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FRgehjoz7Yv8LkUfADxACm

tests/test_sync.py

@@ -0,0 +1,58 @@
+import pytest
+
+from thoughtsync.app import create_app
+from thoughtsync.sync import DEFAULT_LIMIT, MAX_LIMIT, _clamp_limit, _page_cursor, _parse_since
+
+
+@pytest.fixture
+def app():
+    return create_app()
+
+
+async def test_changes_requires_auth(app):
+    client = app.test_client()
+    resp = await client.get("/api/sync/changes")
+    assert resp.status_code == 401
+
+
+def test_parse_since():
+    assert _parse_since(None) == 0
+    assert _parse_since("42") == 42
+    assert _parse_since("-5") == 0  # negative clamps to 0
+    assert _parse_since("garbage") == 0
+
+
+def test_clamp_limit():
+    assert _clamp_limit(None) == DEFAULT_LIMIT
+    assert _clamp_limit("10") == 10
+    assert _clamp_limit("0") == 1  # floor of 1
+    assert _clamp_limit("999999") == MAX_LIMIT
+    assert _clamp_limit("nope") == DEFAULT_LIMIT
+
+
+def test_page_cursor_all_drained():
+    # Neither stream is full → cursor is the max revision seen; nothing more to page.
+    cursor, more = _page_cursor([1, 3, 5], [2, 4], since=0, limit=500)
+    assert cursor == 5
+    assert more is False
+
+
+def test_page_cursor_empty():
+    # No changes since the cursor → cursor stays put, no more pages.
+    cursor, more = _page_cursor([], [], since=7, limit=500)
+    assert cursor == 7
+    assert more is False
+
+
+def test_page_cursor_one_stream_full_advances_to_its_boundary():
+    # Notes came back full (limit=3) → truncate at its boundary; later labels defer.
+    cursor, more = _page_cursor([1, 2, 3], [4, 5], since=0, limit=3)
+    assert cursor == 3
+    assert more is True
+
+
+def test_page_cursor_both_full_uses_min_boundary():
+    # Both full → advance only to the SMALLER boundary so neither stream skips a gap.
+    cursor, more = _page_cursor([1, 2, 10], [3, 4, 5], since=0, limit=3)
+    assert cursor == 5
+    assert more is True