upgrade gitsheets 1.4.1 → 2.x (Rust core), pairing with upstream per-sheet refresh (gitsheets#184)

The API is pinned to \`gitsheets ^1.4.1\` — a full major version behind the 2.x line, which replaced the JS engine with a Rust core (canonical TOML, schema validation, and tree ops all native; measured ~4–5× faster on large-sheet commit workloads, with byte-identical output). A migration guide ships with 2.x.

Beyond the version bump, the upgrade is the right moment to retire three workarounds that all trace to the stale-\`Sheet\`-cache gap tracked upstream as JarvusInnovations/gitsheets#184:

- \`apps/api/src/store/store.ts\` — \`swapPublic()\` and the funnel-all-reads-through-memory rule exist because direct \`sheet.query*()\` after a transact reads the pre-commit tree (documented in \`specs/behaviors/storage.md\` under "Direct gitsheets reads after a transact").
- \`apps/api/src/routes/attachments.ts\` — deliberately bypasses \`Sheet.getAttachment()\` and streams via raw \`git cat-file\` to dodge the same cache.
- \`apps/api/src/lib/data-repo-lock.ts\` — a parallel mutex because gitsheets' internal one isn't exposed for non-transact git ops.

Ideally the upgrade lands alongside (or drives) the upstream #184 implementation so those can be deleted rather than ported.

Also worth checking during the upgrade: the \`asValidator()\` cast in \`apps/api/src/store/public.ts\` (Zod v4 vs \`StandardSchemaResult\` structural mismatch) and the \`BlobObject.write(hologit, buf as unknown as string)\` casts (\`importer.ts\`, \`people.ts\`) — the 2.x API surface (\`BlobHandle\`, typed error classes) may eliminate both.

Commencez par le guide de migration de gitsheets 2.x et l’issue upstream #184, puis examinez apps/api/src/store/store.ts, apps/api/src/routes/attachments.ts, apps/api/src/lib/data-repo-lock.ts, apps/api/src/store/public.ts, importer.ts et people.ts. C’est terminé lorsque l’API s’exécute sur 2.x, que les contournements liés au cache obsolète sont supprimés lorsque le support upstream le permet et que les casts indiqués sont vérifiés par rapport à la nouvelle API.

Rédigé par le modèle d'indexation à partir du texte de l'issue.