fix(sync): point stale toku sync init guidance at signup/login/enroll

[kafkade]

Description

Three small follow-ups from epic #207: the CLI still told users to run the deprecated toku sync init, and two docs files described a reality the tree has moved past.

What's included

• Stale sync guidance (CLI: stale error strings point users at deprecated toku sync init #221) — every error/hint that pointed at the deprecated toku sync init now names the command that actually fits its situation:

  • no sync config → toku sync signup (new account) / toku sync enroll (existing account)
  • no auth token for the server → toku sync login
  • after toku sync disable → toku sync enroll to re-enable. (Checked the code rather than guessing: orchestrator::login() only mints a device session when config.sync still carries a device_id, and disable clears it — so login alone cannot restore sync.)
  • toku sync compact with no device identity → signup / enroll
  • missing library key (compact, push, snapshot download) → login to unlock with password + Secret Key, or enroll to enroll the device

  Fixed in crates/toku-cli/src/main.rs and in crates/toku-sync-client/src/orchestrator.rs. The latter is not named in the issue, but its errors are printed verbatim by toku sync push/pull/bootstrap, so they are CLI error strings and fall under the same acceptance criterion.

  The deprecated toku sync init command, its [Deprecated] help text, and its runtime deprecation notice are unchanged — only guidance text moved. No behavior change, and no test asserted on any of these strings.

• ROADMAP §7.5 (Docs: ROADMAP §7.5 still marks self-hosted sync server 🔴 "Deferred" though it shipped #224) — "Self-Hosted Sync Server" was 🔴 "Deferred to Phase 7" while the server has actually shipped. Now 🟡 with a shipped/remaining split matching the existing Phase 7 style: shipped = the Axum toku-sync server (ADR-008 wire protocol), mandatory zero-knowledge E2E, two-secret SRP (ADR-010), the self-hostable Docker image with first-run admin onboarding, op-log emission (Sync: generate ops for every frontend mutation (CLI/FFI/web/import) #194) and new-device bootstrap (Sync: upload existing state on first opt-in + wire/expose new-device bootstrap #199); remaining = genuine multi-device client integration across iOS/macOS/web/Windows. A short bullet notes the managed-tier controls from Managed-tier server hardening: per-user quotas, rate limiting, server backup, signup #206 (per-user quotas, per-user rate limiting, admin-scoped encrypted backup, signup email verification), which are off by default and preserve the zero-knowledge guarantee. Each claim was verified against the tree, not copied from the issue text. The export table's backup row was also aligned to Phase 2 ✅ (#200) so it keeps planned-phase info like its neighbors.

• Agent instructions (Docs: copilot-instructions references non-existent .github/workflows/ci.yml (actual file is validate.yml) #228) — the CI/infrastructure note pointed at .github/workflows/ci.yml, which does not exist. Corrected to .github/workflows/validate.yml (workflow name: CI, gating job Validate). No stale reference remains repo-wide.

Note on scope

One hunk is a deliberate extra, outside the issue's stated scope: crates/toku-web/src/views.rs:62, the read-only sync page copy, which had the same stale toku sync init instruction. #221 is scoped to CLI messages, so this is a different surface (web copy). It's one line and leaving it wrong seemed worse than fixing it — but it is cleanly separable and can be dropped without affecting anything else in this PR.

No CI job was renamed, added, or removed, so no kafkade/github-infra Terraform change is needed.

Related Issues

Closes #221
Closes #224
Closes #228

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Documentation update
• Refactoring (no functional changes)
• CI / infrastructure
• Other (describe below)

Crate

• toku-core — Domain models, traits, state machine
• toku-db — SQLite persistence, migrations, FTS5
• toku-import — Importers (Goodreads, Calibre, StoryGraph)
• toku-meta — Metadata fetching (Open Library, Google Books)
• toku-cli — CLI binary
• toku-export — Exporters (CSV, JSON, Markdown, BibTeX)
• docs/ — Documentation (ROADMAP.md, .github/copilot-instructions.md)

Also touched: toku-sync-client (CLI-visible sync errors) and toku-web (sync page copy — the out-of-scope extra noted above).

Data Integrity Checklist

• No user data is sent to any server without explicit opt-in — message text only; no network or storage behavior changed
• Import operations are idempotent (re-importing the same file creates no duplicates) — N/A, importers untouched
• User edits to metadata are never overwritten by auto-enrichment — N/A, no metadata paths touched
• New fields track provenance (source + timestamp) — N/A, no new fields
• Export round-trip is preserved (if applicable) — N/A, exporters untouched

Checklist

• I have read CONTRIBUTING.md
• cargo fmt --check passes
• cargo clippy --workspace -- -D warnings passes
• cargo test --workspace passes
• I have updated documentation (if applicable)