feat: socle BDD (tâche 1.9 Phase 1-2) + moteur APT (tâche 2 SJ-0→3) + WIP capabilities/auth/Rust

Checkpoint multi-chantiers (arbre vert : tsc 0 erreur, 70 tests, build OK).
- tâche 1.9 Phase 1 : schéma socle (machine_state/events/reports/raw_artifacts/
  hardware/metrics + colonnes étendues) + wiring refresh/execute. Migration 0002.
- tâche 1.9 Phase 2 : machine_credentials + machine_host_keys (non destructif,
  dual-read + backfill). Migration 0003. Fix séquence journal de migration.
- tâche 2 : SJ-0 (types étendus rétro-compatibles, réducteur Docker, resolveTemplate),
  SJ-1 (update-analyze enrichi), SJ-2 (apply + diff dpkg + timeout inactivité SSH),
  SJ-3 (reboot vérifié boot_id).
- WIP parallèle inclus : /api/capabilities, auth/apiTokens/apiClients, system metrics,
  scaffold app_rust, ajustements frontend.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

server/templates/aptReduce.ts

@@ -1,11 +1,22 @@
 // server/templates/aptReduce.ts
-const PREFIXES = ["Inst ", "Conf ", "Remv ", "Err ", "E:", "W:", "dpkg:"];
-const CONTAINS = ["reboot-required", "REBOOT_REQUIRED"];
+const PREFIXES = [
+  // APT / dpkg (jalon 1)
+  "Inst ", "Conf ", "Remv ", "Err ", "E:", "W:", "dpkg:",
+  // Docker (SJ-0)
+  "Pulling", "Digest", "Status", "Downloaded newer image", "Recreating", "Started", "Error",
+];
+const CONTAINS = [
+  "reboot-required", "REBOOT_REQUIRED",
+  "deleted", "Total reclaimed space",
+];
 
-/** Garde uniquement les lignes informatives d'une sortie APT brute. */
-export function reduceAptLines(raw: string): string[] {
+/** Garde uniquement les lignes informatives (APT + Docker) d'une sortie brute. */
+export function reduceLines(raw: string): string[] {
   return raw
     .split("\n")
     .map((l) => l.trimEnd())
     .filter((l) => PREFIXES.some((p) => l.startsWith(p)) || CONTAINS.some((c) => l.includes(c)));
 }
+
+/** Alias rétro-compatible (jalon 1) : même comportement, conserve les imports existants. */
+export const reduceAptLines = reduceLines;