chore(deno): migrate toolchain from Node 24 + pnpm to Deno 2.9.7 + TypeScript 7.0.2 (W1.5)

- root deno.json workspace (nodeModulesDir auto), npm versions registered once in imports, deno.lock;
  remove pnpm-lock/pnpm-workspace/root package.json; members keep minimal package.json (name/type/exports)
- tasks: dev, typecheck (tsc 7.0.2 per member + deno check), lint/fmt (biome, useImportExtensions),
  test (vitest via deno), check:tokens, build (web + deno compile), ci, db:migrate/reset, gen:types
- tsconfig base moved to config/ (no root tsconfig.json); deno types -> types/deno.d.ts; web drops baseUrl
- server: Deno.serve entry with graceful shutdown, --role migrate|preflight|probe, WEB_ROOT static SPA hosting;
  drop @hono/node-server, tsx, esbuild build.mjs
- logger: redact child() bindings and serialize err by message/stack; sync stdout destination; tests
- relative imports get explicit extensions (sites/mp-sync paths left for follow-up)
- crash-recovery tests spawn `deno run -A`; tasks tests use unique per-file schemas
- single-container Dockerfile + entrypoint (migrate -> preflight -> api+worker watchdog), docker-compose.yml
- docs: README, runbook, ADR-001 superseded, plan §1 validation row

Co-Authored-By: Claude Fable 5.1 <[email protected]>

apps/server/test/preflight.test.ts

@@ -0,0 +1,47 @@
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import type { DB, Kysely } from "@umt/db";
+import { afterAll, describe, expect, it } from "vitest";
+import { type Config, ConfigSchema } from "../src/config.ts";
+import { runPreflight } from "../src/preflight.ts";
+
+const dir = mkdtempSync(join(tmpdir(), "umt-pre-"));
+afterAll(() => rmSync(dir, { recursive: true, force: true }));
+
+// 最小假 Kysely:只需要 sql`select 1`.execute(db) 走得通或失败
+const fakeDb = (ok: boolean) =>
+  ({
+    getExecutor: () => ({
+      transformQuery: (n: unknown) => n,
+      compileQuery: (n: unknown) => ({ sql: "select 1", parameters: [], query: n }),
+      executeQuery: async () => {
+        if (!ok) throw new Error("connect ECONNREFUSED");
+        return { rows: [{ "?column?": 1 }] };
+      },
+    }),
+  }) as unknown as Kysely<DB>;
+
+const cfg = (over: Record<string, string>): Config =>
+  ConfigSchema.parse({ DATABASE_URL: "postgres://x/y", SECRET_MASTER_KEY: "a-real-random-secret-value-123", ...over });
+
+describe("启动自检", () => {
+  it("开发环境、DB 可达 → 通过", async () => {
+    expect(await runPreflight({ config: cfg({}), db: fakeDb(true), uid: 0 })).toEqual([]);
+  });
+
+  it("生产环境:占位符密钥、root、DB 不可达、WEB_ROOT 缺 index.html 都报出", async () => {
+    const problems = await runPreflight({
+      config: cfg({ NODE_ENV: "production", SECRET_MASTER_KEY: "dev-only-change-me-dev-only", WEB_ROOT: dir }),
+      db: fakeDb(false),
+      uid: 0,
+    });
+    expect(problems.map((p) => p.check).sort()).toEqual(["db", "secret", "user", "web"]);
+  });
+
+  it("WEB_ROOT 有 index.html、非 root → 通过", async () => {
+    writeFileSync(join(dir, "index.html"), "<!doctype html>");
+    const config = cfg({ NODE_ENV: "production", WEB_ROOT: dir });
+    expect(await runPreflight({ config, db: fakeDb(true), uid: 1000 })).toEqual([]);
+  });
+});