feat: socle BDD (tâche 1.9 Phase 1-2) + moteur APT (tâche 2 SJ-0→3) + WIP capabilities/auth/Rust

Checkpoint multi-chantiers (arbre vert : tsc 0 erreur, 70 tests, build OK).
- tâche 1.9 Phase 1 : schéma socle (machine_state/events/reports/raw_artifacts/
  hardware/metrics + colonnes étendues) + wiring refresh/execute. Migration 0002.
- tâche 1.9 Phase 2 : machine_credentials + machine_host_keys (non destructif,
  dual-read + backfill). Migration 0003. Fix séquence journal de migration.
- tâche 2 : SJ-0 (types étendus rétro-compatibles, réducteur Docker, resolveTemplate),
  SJ-1 (update-analyze enrichi), SJ-2 (apply + diff dpkg + timeout inactivité SSH),
  SJ-3 (reboot vérifié boot_id).
- WIP parallèle inclus : /api/capabilities, auth/apiTokens/apiClients, system metrics,
  scaffold app_rust, ajustements frontend.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

server/services/machineState.test.ts

@@ -0,0 +1,27 @@
+// server/services/machineState.test.ts
+import { describe, it, expect } from "vitest";
+import { deriveAptState } from "./machineState.js";
+import type { UpdateSnapshot } from "@shared/types.js";
+
+const snap: UpdateSnapshot = {
+  machineId: "m1", hostname: "h", os: { family: "debian", version: "12" },
+  checkedAt: "2026-06-05T10:00:00Z", status: "updates_available",
+  apt: { enabled: true, count: 3, rebootRequired: true, packages: [] },
+};
+
+describe("deriveAptState", () => {
+  it("dérive le bloc APT de machine_state depuis un snapshot", () => {
+    expect(deriveAptState(snap)).toEqual({
+      status: "updates_available",
+      aptStatus: "updates_available",
+      aptUpdatesCount: 3,
+      aptRebootRequired: 1,
+      aptLastAnalyzeAt: "2026-06-05T10:00:00Z",
+    });
+  });
+
+  it("met rebootRequired à 0 quand absent", () => {
+    const s = { ...snap, status: "ok" as const, apt: { ...snap.apt, count: 0, rebootRequired: false } };
+    expect(deriveAptState(s)).toMatchObject({ aptUpdatesCount: 0, aptRebootRequired: 0, status: "ok" });
+  });
+});