feat: socle BDD (tâche 1.9 Phase 1-2) + moteur APT (tâche 2 SJ-0→3) + WIP capabilities/auth/Rust

Checkpoint multi-chantiers (arbre vert : tsc 0 erreur, 70 tests, build OK).
- tâche 1.9 Phase 1 : schéma socle (machine_state/events/reports/raw_artifacts/
  hardware/metrics + colonnes étendues) + wiring refresh/execute. Migration 0002.
- tâche 1.9 Phase 2 : machine_credentials + machine_host_keys (non destructif,
  dual-read + backfill). Migration 0003. Fix séquence journal de migration.
- tâche 2 : SJ-0 (types étendus rétro-compatibles, réducteur Docker, resolveTemplate),
  SJ-1 (update-analyze enrichi), SJ-2 (apply + diff dpkg + timeout inactivité SSH),
  SJ-3 (reboot vérifié boot_id).
- WIP parallèle inclus : /api/capabilities, auth/apiTokens/apiClients, system metrics,
  scaffold app_rust, ajustements frontend.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

server/services/capabilities.test.ts

@@ -0,0 +1,31 @@
+// server/services/capabilities.test.ts
+import { describe, expect, it } from "vitest";
+import { getServerCapabilities } from "./capabilities.js";
+
+describe("getServerCapabilities", () => {
+  it("publie un contrat stable sans annoncer les fonctions futures non implémentées", () => {
+    const caps = getServerCapabilities(new Date("2026-06-05T08:00:00.000Z"));
+
+    expect(caps).toMatchObject({
+      app: "system_update",
+      apiVersion: "1",
+      generatedAt: "2026-06-05T08:00:00.000Z",
+      features: {
+        machines: true,
+        actions: true,
+        terminalOutput: true,
+        docker: false,
+        hermes: false,
+        interactiveSsh: false,
+        authTokens: false,
+      },
+      endpoints: {
+        capabilities: "GET /api/capabilities",
+        systemStatus: "GET /api/system/status",
+        systemMetrics: "GET /api/system/metrics",
+        machines: "GET /api/machines",
+        terminalOutputWs: "WS /api/ws/machines/:id/output",
+      },
+    });
+  });
+});