chore(deno): migrate toolchain from Node 24 + pnpm to Deno 2.9.7 + TypeScript 7.0.2 (W1.5)

- root deno.json workspace (nodeModulesDir auto), npm versions registered once in imports, deno.lock;
  remove pnpm-lock/pnpm-workspace/root package.json; members keep minimal package.json (name/type/exports)
- tasks: dev, typecheck (tsc 7.0.2 per member + deno check), lint/fmt (biome, useImportExtensions),
  test (vitest via deno), check:tokens, build (web + deno compile), ci, db:migrate/reset, gen:types
- tsconfig base moved to config/ (no root tsconfig.json); deno types -> types/deno.d.ts; web drops baseUrl
- server: Deno.serve entry with graceful shutdown, --role migrate|preflight|probe, WEB_ROOT static SPA hosting;
  drop @hono/node-server, tsx, esbuild build.mjs
- logger: redact child() bindings and serialize err by message/stack; sync stdout destination; tests
- relative imports get explicit extensions (sites/mp-sync paths left for follow-up)
- crash-recovery tests spawn `deno run -A`; tasks tests use unique per-file schemas
- single-container Dockerfile + entrypoint (migrate -> preflight -> api+worker watchdog), docker-compose.yml
- docs: README, runbook, ADR-001 superseded, plan §1 validation row

Co-Authored-By: Claude Fable 5.1 <[email protected]>

apps/server/src/http/app.ts

@@ -5,14 +5,15 @@ import { cors } from "hono/cors";
 import { HTTPException } from "hono/http-exception";
 import { requestId } from "hono/request-id";
 import type { Logger } from "pino";
-import type { Config } from "../config";
-import { isDev } from "../config";
-import { redactString } from "../logger";
-import { type ApiKeyStore, type AuthEnv, apiKeyAuth, kyselyApiKeyStore, requireScope } from "./auth";
-import { ApiException, errorBody } from "./errors";
-import { healthRoutes } from "./routes/health";
-import { mountOpenApi } from "./routes/openapi";
-import { type EventBus, sseRoutes } from "./sse";
+import type { Config } from "../config.ts";
+import { isDev } from "../config.ts";
+import { redactString } from "../logger.ts";
+import { type ApiKeyStore, type AuthEnv, apiKeyAuth, kyselyApiKeyStore, requireScope } from "./auth.ts";
+import { ApiException, errorBody } from "./errors.ts";
+import { healthRoutes } from "./routes/health.ts";
+import { mountOpenApi } from "./routes/openapi.ts";
+import { type EventBus, sseRoutes } from "./sse.ts";
+import { mountWebRoot } from "./static.ts";
 
 export interface AppDeps {
   config: Pick<Config, "NODE_ENV" | "DEV_ADMIN_KEY">;
@@ -24,6 +25,8 @@ export interface AppDeps {
   db?: Kysely<DB>;
   /** 测试可注入;默认用 db 构造 */
   apiKeyStore?: ApiKeyStore;
+  /** 单容器模式:托管 web 静态产物的目录 */
+  webRoot?: string;
 }
 
 export const API_PREFIX = "/api/v1";
@@ -109,6 +112,8 @@ export function createApp(deps: AppDeps) {
     return c.json({ ok: true, data: { id: p.id, name: p.name, kind: p.kind, scopes: p.scopes } });
   });
 
+  if (deps.webRoot) mountWebRoot(app, deps.webRoot);
+
   return app;
 }
 export type App = ReturnType<typeof createApp>;