feat: socle BDD (tâche 1.9 Phase 1-2) + moteur APT (tâche 2 SJ-0→3) + WIP capabilities/auth/Rust

Checkpoint multi-chantiers (arbre vert : tsc 0 erreur, 70 tests, build OK).
- tâche 1.9 Phase 1 : schéma socle (machine_state/events/reports/raw_artifacts/
  hardware/metrics + colonnes étendues) + wiring refresh/execute. Migration 0002.
- tâche 1.9 Phase 2 : machine_credentials + machine_host_keys (non destructif,
  dual-read + backfill). Migration 0003. Fix séquence journal de migration.
- tâche 2 : SJ-0 (types étendus rétro-compatibles, réducteur Docker, resolveTemplate),
  SJ-1 (update-analyze enrichi), SJ-2 (apply + diff dpkg + timeout inactivité SSH),
  SJ-3 (reboot vérifié boot_id).
- WIP parallèle inclus : /api/capabilities, auth/apiTokens/apiClients, system metrics,
  scaffold app_rust, ajustements frontend.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

server/db/schema.test.ts

@@ -0,0 +1,59 @@
+// server/db/schema.test.ts
+import { describe, it, expect } from "vitest";
+import Database from "better-sqlite3";
+import { drizzle } from "drizzle-orm/better-sqlite3";
+import { migrate } from "drizzle-orm/better-sqlite3/migrator";
+
+function freshMigratedDb() {
+  const sqlite = new Database(":memory:");
+  const db = drizzle(sqlite);
+  migrate(db, { migrationsFolder: "./server/db/migrations" });
+  return sqlite;
+}
+
+function tableNames(sqlite: Database.Database): string[] {
+  return sqlite.prepare("SELECT name FROM sqlite_master WHERE type='table'").all().map((r: any) => r.name);
+}
+function columnNames(sqlite: Database.Database, table: string): string[] {
+  return sqlite.prepare(`PRAGMA table_info(${table})`).all().map((r: any) => r.name);
+}
+
+describe("schéma Phase 1", () => {
+  it("crée les tables socle", () => {
+    const sqlite = freshMigratedDb();
+    const tables = tableNames(sqlite);
+    for (const t of [
+      "machines", "snapshots", "executions",
+      "machine_state", "machine_hardware", "machine_metrics_latest",
+      "machine_events", "important_messages", "reports", "raw_artifacts",
+    ]) {
+      expect(tables, `table ${t}`).toContain(t);
+    }
+  });
+
+  it("ajoute les colonnes étendues sans casser l'existant", () => {
+    const sqlite = freshMigratedDb();
+    expect(columnNames(sqlite, "machines")).toEqual(
+      expect.arrayContaining(["machine_kind", "virtualization", "hardware_profile", "os_version", "updated_at"]),
+    );
+    expect(columnNames(sqlite, "snapshots")).toEqual(
+      expect.arrayContaining(["kind", "schema_version", "important_json"]),
+    );
+    expect(columnNames(sqlite, "executions")).toEqual(
+      expect.arrayContaining(["schema_version", "error_kind", "error_message", "exit_code"]),
+    );
+    // colonnes jalon 1 conservées
+    expect(columnNames(sqlite, "snapshots")).toContain("checked_at");
+    expect(columnNames(sqlite, "machines")).toContain("enc_password");
+  });
+});
+
+describe("schéma Phase 2", () => {
+  it("crée les tables de credentials Phase 2", () => {
+    const sqlite = freshMigratedDb();
+    const tables = tableNames(sqlite);
+    expect(tables).toEqual(expect.arrayContaining(["machine_credentials", "machine_host_keys"]));
+    // machines conserve ses colonnes secrets legacy (fallback)
+    expect(columnNames(sqlite, "machines")).toContain("enc_password");
+  });
+});