feat: socle BDD (tâche 1.9 Phase 1-2) + moteur APT (tâche 2 SJ-0→3) + WIP capabilities/auth/Rust

Checkpoint multi-chantiers (arbre vert : tsc 0 erreur, 70 tests, build OK).
- tâche 1.9 Phase 1 : schéma socle (machine_state/events/reports/raw_artifacts/
  hardware/metrics + colonnes étendues) + wiring refresh/execute. Migration 0002.
- tâche 1.9 Phase 2 : machine_credentials + machine_host_keys (non destructif,
  dual-read + backfill). Migration 0003. Fix séquence journal de migration.
- tâche 2 : SJ-0 (types étendus rétro-compatibles, réducteur Docker, resolveTemplate),
  SJ-1 (update-analyze enrichi), SJ-2 (apply + diff dpkg + timeout inactivité SSH),
  SJ-3 (reboot vérifié boot_id).
- WIP parallèle inclus : /api/capabilities, auth/apiTokens/apiClients, system metrics,
  scaffold app_rust, ajustements frontend.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

server/db/migrations/0003_magical_psylocke.sql

@@ -0,0 +1,28 @@
+CREATE TABLE `machine_credentials` (
+	`machine_id` text PRIMARY KEY NOT NULL,
+	`auth_method` text NOT NULL,
+	`enc_password` text,
+	`enc_sudo_password` text,
+	`enc_private_key` text,
+	`enc_key_passphrase` text,
+	`sudo_mode` text NOT NULL,
+	`created_at` text NOT NULL,
+	`updated_at` text NOT NULL,
+	`last_test_at` text,
+	`status` text,
+	FOREIGN KEY (`machine_id`) REFERENCES `machines`(`id`) ON UPDATE no action ON DELETE cascade
+);
+--> statement-breakpoint
+CREATE TABLE `machine_host_keys` (
+	`id` text PRIMARY KEY NOT NULL,
+	`machine_id` text,
+	`hostname` text NOT NULL,
+	`port` integer NOT NULL,
+	`key_type` text,
+	`fingerprint_sha256` text NOT NULL,
+	`public_key` text,
+	`status` text NOT NULL,
+	`first_seen_at` text NOT NULL,
+	`last_seen_at` text NOT NULL,
+	FOREIGN KEY (`machine_id`) REFERENCES `machines`(`id`) ON UPDATE no action ON DELETE cascade
+);