feat: socle BDD (tâche 1.9 Phase 1-2) + moteur APT (tâche 2 SJ-0→3) + WIP capabilities/auth/Rust

Checkpoint multi-chantiers (arbre vert : tsc 0 erreur, 70 tests, build OK).
- tâche 1.9 Phase 1 : schéma socle (machine_state/events/reports/raw_artifacts/
  hardware/metrics + colonnes étendues) + wiring refresh/execute. Migration 0002.
- tâche 1.9 Phase 2 : machine_credentials + machine_host_keys (non destructif,
  dual-read + backfill). Migration 0003. Fix séquence journal de migration.
- tâche 2 : SJ-0 (types étendus rétro-compatibles, réducteur Docker, resolveTemplate),
  SJ-1 (update-analyze enrichi), SJ-2 (apply + diff dpkg + timeout inactivité SSH),
  SJ-3 (reboot vérifié boot_id).
- WIP parallèle inclus : /api/capabilities, auth/apiTokens/apiClients, system metrics,
  scaffold app_rust, ajustements frontend.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

server/services/capabilities.ts

@@ -0,0 +1,38 @@
+// server/services/capabilities.ts
+import type { ServerCapabilities } from "@shared/types.js";
+
+export function getServerCapabilities(now = new Date()): ServerCapabilities {
+  return {
+    app: "system_update",
+    apiVersion: "1",
+    generatedAt: now.toISOString(),
+    features: {
+      machines: true,
+      machineSnapshots: true,
+      actions: true,
+      aptFullUpgrade: true,
+      reboot: true,
+      reports: true,
+      terminalOutput: true,
+      interactiveSsh: false,
+      docker: false,
+      postInstall: false,
+      hermes: false,
+      settings: false,
+      scheduledJobs: false,
+      authTokens: false,
+    },
+    endpoints: {
+      capabilities: "GET /api/capabilities",
+      systemStatus: "GET /api/system/status",
+      systemMetrics: "GET /api/system/metrics",
+      machines: "GET /api/machines",
+      machineSnapshot: "GET /api/machines/:id/snapshot",
+      machineRefresh: "POST /api/machines/:id/refresh",
+      machineActions: "POST /api/machines/:id/actions",
+      machineExecutions: "GET /api/machines/:id/executions",
+      executionReport: "GET /api/machines/:id/executions/:execId/report",
+      terminalOutputWs: "WS /api/ws/machines/:id/output",
+    },
+  };
+}