refactor(call-to-play): merge histories atomically

Replace per-event insertion with a transactional batch merge. The store now
validates and deduplicates an entire history before committing it, rejects
conflicting event IDs without partial mutation, evaluates retention after all
batch events are present, and reports applied, duplicate, obsolete, and
missing-root outcomes explicitly.

Derive event identity from retained history instead of preserving an unbounded
ID set. Expired histories can therefore be restored by a complete Create plus
AddTime batch, while orphan actions request history and terminal tombstones
continue to reject stale resurrection. Capacity applies only to unresolved
history, allowing Start and Cancel to settle a full call.

Only retained events reach the UI or live broadcast path. Handshake and live
merge callers log invalid or incomplete histories without publishing events
that compaction discarded.

Test Plan:
- `just fmt` -- passed
- `just clippy` -- passed
- `just test` -- passed
- `git diff --cached --check` -- passed

crates/lanspread-peer/src/lib.rs

@@ -504,9 +504,7 @@ async fn handle_peer_commands(
                 handle_connect_peer_command(ctx, tx_notify_ui, addr).await;
             }
             PeerCommand::PublishCallToPlay { event, reply } => {
-                let result = call_to_play::publish(ctx, tx_notify_ui, event)
-                    .await
-                    .map_err(str::to_owned);
+                let result = call_to_play::publish(ctx, tx_notify_ui, event).await;
                 let _ = reply.send(result);
             }
             PeerCommand::GetCallToPlayEvents { reply } => {