Audit write path for a per-principal (not global) single-writer invariant before horizontal scaling

Precondition for whenever the Cyphr server is scaled to multiple stateless processes sharing one physical store — see #26 for the design reasoning this follows from.

Today's write-path exclusivity is enforced in-process only (`&mut self`, `!Clone` on storage backends, an `Arc` around `CloneableLog`). That's fine for one process, but going horizontal needs single-writer enforcement to hold *per principal, across processes* — via a lease or partition-ownership token, not a global lock.

The audit: walk the write path and confirm nothing assumes global exclusivity in a way a per-principal ownership token wouldn't satisfy — no global in-memory counters, no cross-principal ordering assumptions. The codebase looks already well-shaped for this (state is already partitioned by principal, ordering is already a per-principal chain, blobs are already idempotent/content-addressed) — so this is expected to be a confirmation pass, not a refactor.

Not urgent for the current campaign; whether it's needed at all depends on the server's availability requirements (a single-node-plus-failover deployment can defer this indefinitely). Surfacing now so it's not missed when scoping the next campaign.

Part of the broader server production-readiness effort tracked in #23.

Walk the server write path and inspect the storage, state-partitioning, ordering, and blob-handling code described in the issue. Check for global in-memory counters or cross-principal ordering assumptions, and verify that each invariant can hold with per-principal ownership across processes. Done means recording whether the audit confirms the current design or identifies a concrete incompatibility.

Written by the indexing model from the issue text.