#2415 serve: remove the remaining no-path markDirty() calls that force full-cache datastore pushes

Description

Eleven serve code paths call syncService.markDirty() with no relPath just before pushChanged. In the S3 and GCS datastore extensions, a no-path markDirty() sets bulkInvalidated. The next push then ignores the per-path dirty set:

• it rebuilds the index from every remote shard;
• it walks, and on a cache filled by pulling hashes, every cached file;
• it rewrites the whole local index.

For a mutation that touches a handful of files, the push costs time proportional to the whole cache. PR #2459 (swamp-club#2154) removed this call from the handlers whose repositories already send per-path marks. swamp-club#2408 removes it from the OAuth login mint, where it made each login do a full-cache push. swamp-club#2408 also adds a fitness test that pins the remaining sites, so the list can only shrink. This issue covers those remaining sites.

Remaining call sites (main at 379bb5f0)

• src/serve/handlers/access_handlers.ts:756 (access.reload)
• src/serve/handlers/vault_handlers.ts:378, :728, :803, :876 (vault create, edit, delete, annotate/migrate)
• src/serve/handlers/admin_handlers.ts:689, :812, :892, :1080, :1261 (extension install, pull, rm, update and related admin paths)
• src/cli/commands/serve.ts:1851 (boot-time server-token definition migration)

What each site needs

For each site, check whether every file it writes or deletes goes through a repository wired with the per-path markDirty hook (repo_context.ts).

• If it does, delete the no-path call and remove the site from the fitness test's pin, as #2459 did for the model and workflow handlers.
• If it does not (extension install writes whole source trees, for example), either add per-path marks for those writes or keep the no-path call. Then record in the pin why the site is exempt.

Deletions need particular care. #2154 was a delete that did not propagate, because the no-path call forced a full-walk push that skips deletion detection.

Evidence

Reproduction on MinIO with the S3 extension: a login mint that pushes 4 files on a serve cache of 25,014 pulled files took about 5.5 s with the no-path call (a full walk, 532 shard GETs, every file hashed). The same writes with only per-path marks took about 0.25 s (a scoped walk, 5 shard GETs). The full evidence is in the swamp-club#2408 reproduction.