chore(deno): migrate toolchain from Node 24 + pnpm to Deno 2.9.7 + TypeScript 7.0.2 (W1.5)

- root deno.json workspace (nodeModulesDir auto), npm versions registered once in imports, deno.lock;
  remove pnpm-lock/pnpm-workspace/root package.json; members keep minimal package.json (name/type/exports)
- tasks: dev, typecheck (tsc 7.0.2 per member + deno check), lint/fmt (biome, useImportExtensions),
  test (vitest via deno), check:tokens, build (web + deno compile), ci, db:migrate/reset, gen:types
- tsconfig base moved to config/ (no root tsconfig.json); deno types -> types/deno.d.ts; web drops baseUrl
- server: Deno.serve entry with graceful shutdown, --role migrate|preflight|probe, WEB_ROOT static SPA hosting;
  drop @hono/node-server, tsx, esbuild build.mjs
- logger: redact child() bindings and serialize err by message/stack; sync stdout destination; tests
- relative imports get explicit extensions (sites/mp-sync paths left for follow-up)
- crash-recovery tests spawn `deno run -A`; tasks tests use unique per-file schemas
- single-container Dockerfile + entrypoint (migrate -> preflight -> api+worker watchdog), docker-compose.yml
- docs: README, runbook, ADR-001 superseded, plan §1 validation row

Co-Authored-By: Claude Fable 5.1 <[email protected]>

apps/server/test/logger.test.ts

@@ -1,6 +1,6 @@
 import { describe, expect, it } from "vitest";
-import { redact, redactString } from "../src/logger";
-import { memoryLogger } from "./helpers";
+import { redact, redactString } from "../src/logger.ts";
+import { memoryLogger } from "./helpers.ts";
 
 describe("日志脱敏", () => {
   it("URL query 中的 passkey/token 被替换", () => {
@@ -26,3 +26,37 @@ describe("日志脱敏", () => {
     for (const s of ["SECRET1", "SECRET2", "SECRET3", "SECRET4"]) expect(out).not.toContain(s);
   });
 });
+
+describe("日志脱敏:child 绑定与 Error 序列化", () => {
+  it("child() 绑定的敏感字段被脱敏", () => {
+    const { logger, lines } = memoryLogger();
+    logger.child({ component: "worker", password: "SECRET5", url: "https://x/?passkey=SECRET6" }).warn("child");
+    const out = lines.join("");
+    expect(out).not.toContain("SECRET5");
+    expect(out).not.toContain("SECRET6");
+    const line = JSON.parse(lines.at(-1)!);
+    expect(line.component).toBe("worker");
+    expect(line.password).toBe("[REDACTED]");
+  });
+
+  it("err 按 message/stack 序列化而不是 {},且内容脱敏", () => {
+    const { logger, lines } = memoryLogger();
+    const err = Object.assign(new Error("GET https://x/dl?passkey=SECRET7 failed", { cause: new Error("inner") }), {
+      code: "E_FETCH",
+      token: "SECRET8",
+    });
+    logger.error({ err }, "boom");
+    const line = JSON.parse(lines.at(-1)!);
+    expect(line.err.type).toBe("Error");
+    expect(line.err.message).toBe("GET https://x/dl?passkey=[REDACTED] failed");
+    expect(line.err.stack).toContain("Error: GET https://x/dl?passkey=[REDACTED] failed");
+    expect(line.err.code).toBe("E_FETCH");
+    expect(line.err.token).toBe("[REDACTED]");
+    expect(line.err.cause.message).toBe("inner");
+    expect(lines.join("")).not.toMatch(/SECRET7|SECRET8/);
+  });
+
+  it("redact() 直接处理 Error", () => {
+    expect(redact(new Error("x?token=abc"))).toMatchObject({ type: "Error", message: "x?token=[REDACTED]" });
+  });
+});