feat: socle BDD (tâche 1.9 Phase 1-2) + moteur APT (tâche 2 SJ-0→3) + WIP capabilities/auth/Rust

Checkpoint multi-chantiers (arbre vert : tsc 0 erreur, 70 tests, build OK).
- tâche 1.9 Phase 1 : schéma socle (machine_state/events/reports/raw_artifacts/
  hardware/metrics + colonnes étendues) + wiring refresh/execute. Migration 0002.
- tâche 1.9 Phase 2 : machine_credentials + machine_host_keys (non destructif,
  dual-read + backfill). Migration 0003. Fix séquence journal de migration.
- tâche 2 : SJ-0 (types étendus rétro-compatibles, réducteur Docker, resolveTemplate),
  SJ-1 (update-analyze enrichi), SJ-2 (apply + diff dpkg + timeout inactivité SSH),
  SJ-3 (reboot vérifié boot_id).
- WIP parallèle inclus : /api/capabilities, auth/apiTokens/apiClients, system metrics,
  scaffold app_rust, ajustements frontend.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

server/services/__fixtures__/apt-update-analyze.txt

@@ -0,0 +1,20 @@
+===SU:APT_UPDATE===
+Hit:1 http://deb.debian.org/debian bookworm InRelease
+Reading package lists...
+===SU:APT_SIM_UPGRADE===
+Reading package lists...
+Building dependency tree...
+Inst libc6 [2.31-13] (2.31-13+deb11u5 Debian:11.6/stable [amd64])
+Conf libc6 (2.31-13+deb11u5 Debian:11.6/stable [amd64])
+===SU:APT_SIM_DISTUPGRADE===
+Reading package lists...
+Inst libc6 [2.31-13] (2.31-13+deb11u5 Debian:11.6/stable [amd64])
+Inst newdep (1.0.0 Debian:11.6/stable [all])
+Remv oldpkg [3.2-1]
+Conf libc6 (2.31-13+deb11u5 Debian:11.6/stable [amd64])
+===SU:APT_HELD===
+frozenpkg
+===SU:REBOOT===
+REBOOT_REQUIRED=1
+PKG=linux-image-amd64
+===SU:EXIT=0===