feat(05-01): wire diff generation into snapshot subscriber

- Add RETURNING id to snapshot INSERT for new_snapshot_id capture
- Call generate_and_store_diff after successful commit (best-effort)
- Outer try/except safety net ensures snapshot ack never blocked by diff
- Update subscriber tests to mock diff service

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

backend/tests/test_config_snapshot_subscriber.py

@@ -62,6 +62,9 @@ async def test_new_snapshot_encrypted_and_stored():
     ), patch(
         "app.services.config_snapshot_subscriber.OpenBaoTransitService",
         return_value=mock_openbao,
+    ), patch(
+        "app.services.config_snapshot_subscriber.generate_and_store_diff",
+        new_callable=AsyncMock,
     ):
         await handle_config_snapshot(msg)
 
@@ -248,6 +251,9 @@ async def test_first_snapshot_for_device_always_stored():
     ), patch(
         "app.services.config_snapshot_subscriber.OpenBaoTransitService",
         return_value=mock_openbao,
+    ), patch(
+        "app.services.config_snapshot_subscriber.generate_and_store_diff",
+        new_callable=AsyncMock,
     ):
         await handle_config_snapshot(msg)