feat: socle BDD (tâche 1.9 Phase 1-2) + moteur APT (tâche 2 SJ-0→3) + WIP capabilities/auth/Rust

Checkpoint multi-chantiers (arbre vert : tsc 0 erreur, 70 tests, build OK).
- tâche 1.9 Phase 1 : schéma socle (machine_state/events/reports/raw_artifacts/
  hardware/metrics + colonnes étendues) + wiring refresh/execute. Migration 0002.
- tâche 1.9 Phase 2 : machine_credentials + machine_host_keys (non destructif,
  dual-read + backfill). Migration 0003. Fix séquence journal de migration.
- tâche 2 : SJ-0 (types étendus rétro-compatibles, réducteur Docker, resolveTemplate),
  SJ-1 (update-analyze enrichi), SJ-2 (apply + diff dpkg + timeout inactivité SSH),
  SJ-3 (reboot vérifié boot_id).
- WIP parallèle inclus : /api/capabilities, auth/apiTokens/apiClients, system metrics,
  scaffold app_rust, ajustements frontend.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

shared/types.test.ts

@@ -0,0 +1,34 @@
+import { describe, it, expect } from "vitest";
+import type { UpdateSnapshot, ExecutionResult } from "./types.js";
+
+describe("rétro-compatibilité des contrats", () => {
+  it("un snapshot jalon 1 (sans blocs optionnels) reste valide", () => {
+    const snap: UpdateSnapshot = {
+      machineId: "m1", hostname: "h", os: { family: "debian", version: "12" },
+      checkedAt: "2026-06-05T10:00:00Z", status: "ok",
+      apt: { enabled: true, count: 0, rebootRequired: false, packages: [] },
+    };
+    expect(snap.apt.count).toBe(0);
+  });
+
+  it("une exécution jalon 1 (mode manual, sans blocs) reste valide", () => {
+    const exec: ExecutionResult = {
+      executionId: "e1", machineId: "m1", startedAt: "a", finishedAt: "b",
+      mode: "manual", action: "apt_full_upgrade", status: "ok",
+      rebootRequiredAfterRun: false, importantLogLines: [], rawLogRef: "r", reportRef: "rr",
+    };
+    expect(exec.action).toBe("apt_full_upgrade");
+  });
+
+  it("accepte les nouveaux blocs optionnels", () => {
+    const snap: UpdateSnapshot = {
+      machineId: "m1", hostname: "h", os: { family: "proxmox", version: "8" },
+      checkedAt: "t", status: "updates_available",
+      apt: { enabled: true, count: 1, rebootRequired: false, packages: [], status: "updates_available" },
+      schemaVersion: 1, kind: "apt_update_analyze", machineKind: "proxmox_host",
+      docker: { enabled: false, installed: false, count: 0, stacks: [] },
+      errors: [],
+    };
+    expect(snap.docker?.installed).toBe(false);
+  });
+});