refactor(progress): SaveProgressRequest becomes the canonical PUT payload; GET serializes from the row

Batch H1 steps 1-2 of the hardening plan. Wire contracts frozen; the
pinned shapes are unchanged modulo the whitelisted additive GET keys
(docs/contract_pins.md).

1. One canonical request struct. The web PUT binds SaveProgressRequest
   directly (identity/attribution fields are json:"-" so they stay
   server-owned) and copies its server fields once — the hand-rolled DTO
   and the 20-line field-copy block are gone. Parse set for existing
   clients is IDENTICAL to the old DTO (verified in web/src: the ebook
   reader sends percentage/current_page/total_pages/reading_mode/epubcfi/
   context_text/chapter/zoom_level — reader.ts:3113-3143; the audiobook
   reader sends percentage/chapter/audio_offset_seconds/elapsed_seconds/
   reading_mode — audio.ts:518-520).

2. GET /api/media-items/:id/progress now serializes through one
   row-struct-driven builder instead of a hand-map, so a row column
   cannot be silently forgotten again (the audio_offset_seconds
   omission). Existing keys are verbatim; the row already carried
   audio_offset_seconds/reading_mode/viewport_x-y/zoom_level/
   scroll_position_x-y/panel_number and they surface as WHITELISTED
   additive keys. The web audiobook reader already reads
   audio_offset_seconds (audio.ts:219) — with the key absent,
   durationless books resumed at chapter start (offset always 0); they
   now resume correctly. The conditional context_text bolt-on and the
   server-derived css_selector/anchor_href block are unchanged —
   restore precedence stays percentage-first, never re-derived.

docs/contract_pins.md

@@ -47,3 +47,14 @@ cover_image_path, has_conflict, format_group, badge`.
 
 - **H0 (initial pin)** — the shapes above, captured on the unmodified tree
   at commit `b4ae423`.
+- **H1 (progress canonicalization)** — `GET /api/media-items/:id/progress`
+  Whitelisted ADDITIVE keys (fields the `GetUniversalProgressRow` already
+  carries, now surfaced by the shared row serializer):
+  `audio_offset_seconds, reading_mode, viewport_x, viewport_y, zoom_level,
+  scroll_position_x, scroll_position_y, panel_number`. No key removed or
+  renamed; the no-rows and PUT-response shapes are untouched. The web PUT
+  binds `SaveProgressRequest` directly — its parse set for existing
+  clients is IDENTICAL to the old DTO (verified against web/src
+  reader.ts:3113-3143 and audio.ts:518-520); keys the web never sent
+  (viewport_x/y, panel_number) merely become honor-able. All other pins
+  unchanged.