chore(deno): migrate toolchain from Node 24 + pnpm to Deno 2.9.7 + TypeScript 7.0.2 (W1.5)

- root deno.json workspace (nodeModulesDir auto), npm versions registered once in imports, deno.lock;
  remove pnpm-lock/pnpm-workspace/root package.json; members keep minimal package.json (name/type/exports)
- tasks: dev, typecheck (tsc 7.0.2 per member + deno check), lint/fmt (biome, useImportExtensions),
  test (vitest via deno), check:tokens, build (web + deno compile), ci, db:migrate/reset, gen:types
- tsconfig base moved to config/ (no root tsconfig.json); deno types -> types/deno.d.ts; web drops baseUrl
- server: Deno.serve entry with graceful shutdown, --role migrate|preflight|probe, WEB_ROOT static SPA hosting;
  drop @hono/node-server, tsx, esbuild build.mjs
- logger: redact child() bindings and serialize err by message/stack; sync stdout destination; tests
- relative imports get explicit extensions (sites/mp-sync paths left for follow-up)
- crash-recovery tests spawn `deno run -A`; tasks tests use unique per-file schemas
- single-container Dockerfile + entrypoint (migrate -> preflight -> api+worker watchdog), docker-compose.yml
- docs: README, runbook, ADR-001 superseded, plan §1 validation row

Co-Authored-By: Claude Fable 5.1 <[email protected]>

Dockerfile

@@ -0,0 +1,31 @@
+# 单容器镜像:一个 deno compile 出的 umt-server 二进制,同时承担 API(含 web 静态 SPA)与 worker。
+# PostgreSQL 不在本镜像内,见 docker-compose.yml。
+# 构建:docker build -t uhd-media-tool .    运行时版本锁定 Deno 2.9.7(ADR-004)
+
+FROM denoland/deno:2.9.7 AS build
+WORKDIR /src
+COPY . .
+RUN deno install --frozen
+ARG APP_VERSION=""
+ENV APP_VERSION=${APP_VERSION}
+RUN deno task check:tokens && cd apps/web && deno task build
+# --node-modules-dir=none + --exclude-unused-npm:只嵌入 server 依赖图可达的 npm 包(约 110 MB,而不是整个 node_modules)
+# 权限在编译时固定:--allow-read 只放 /app;不给 --allow-run / --allow-write
+RUN cd apps/server && deno task compile
+
+FROM debian:trixie-slim
+# 不装额外包:Deno 自带 Mozilla 根证书(外呼 HTTPS 不依赖 ca-certificates),健康探测用二进制自身的 fetch
+RUN useradd --system --uid 10001 --home-dir /app --shell /usr/sbin/nologin umt
+WORKDIR /app
+COPY --from=build --chown=root:root /src/dist/umt-server /app/umt-server
+COPY --from=build --chown=root:root /src/apps/web/build/client /app/public
+COPY --chown=root:root --chmod=0755 docker/entrypoint.sh /app/entrypoint.sh
+ENV NODE_ENV=production \
+    HOST=0.0.0.0 \
+    PORT=4380 \
+    WEB_ROOT=/app/public
+USER umt
+EXPOSE 4380
+# 用二进制自带的 fetch 打本机回环端口,不装 curl
+HEALTHCHECK --interval=15s --timeout=5s --start-period=20s --retries=3 CMD ["/app/umt-server", "--role", "probe"]
+ENTRYPOINT ["/app/entrypoint.sh"]