Put Compare Lists

Merge the caller's lists into the account's, and return the result.

This is a MERGE, not a replace, and that is the whole contract:

• entries are unioned by id, keeping the earlier added_at of the two — that is when the component was actually added; a later timestamp is only the other device noticing;
• the union is ordered newest first, ties broken by id, and truncated to ten per type;
• an id that does not resolve to a curated, public component is dropped silently, so a component retired from the catalog leaves the list instead of turning every later sync into an error;
• a type you omit is left exactly as it was — saying nothing about motors is not the same as saying you have no motors.

Union rather than replace is what makes this safe to send from a device that has been offline or is out of date: it can add, and it can reorder by supplying an earlier time, but it cannot delete what another device added.

Sending the device's list on sign-in and storing what comes back is the whole synchronisation: both sides end up holding the same ten.