feat(server): W2-D agent assembly, session API, runAgent/resolveDecision and backend e2e

- Capabilities: all 14 registered (AO: inventory.query, download.plan/submit, organize.plan/execute,
  policy.preview/apply; agent: task.inspect/retry/cancel); startup asserts count == 14.
  Registry injects server-side authorize (automation_grant by action/scope/policy version/budget,
  one-shot approval bound to plan id + payload hash + revision + expiry; model claims ignored;
  automation switch), audit_event, server idempotency keys and a capability_invocation op ledger
  (migration 0021) used for crash reconciliation. download.plan creates draft plans only;
  download.submit promotes draft -> reserved after authorization.
- Agent session API: POST/GET /agent/runs, GET /agent/runs/{id} (events by seq, messages, report),
  POST .../messages (wake), POST .../abort; automation-grants, approvals, capabilities invoke, tasks.
- runAgent task: Pi or fake provider from settings (apiKey via secrets), events persisted to
  agent_run_event then published, resume + ledger reconciliation when pendingOperations > 0,
  waits for goal-linked downloads/imports and reports from business tables (submitted != imported).
- Background triggers: decision.created -> bounded plan_only investigation (dedupe per decision);
  decision.updated(resolved) -> resolveDecision executes chosen option.
- W2 closure: all OpenAPI routes registered in contracts api.ts (+ subset test); TMDB key from
  settings secret_ref with env fallback; PUT /sites/{id}/credentials documented as alias of
  /site-accounts; completion events documented as existing status events.
- e2e (real PG + OpenWorkflow + testkit mocks): RSS->library, agent delegation with grant/deny,
  background continuation, worker kill -9 recovery (single qB add), auto investigation dedupe.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

apps/server/src/modules/sources-identity/runtime.ts

@@ -40,6 +40,7 @@ export class SourcesRuntime {
   readonly rss: RssFetcher;
   private readonly adapters = new Map<string, CachedAdapter>();
   private tmdbClient: TmdbClient | null | undefined;
+  private tmdbSig: string | null = null;
 
   constructor(
     readonly ctx: ServerContext,
@@ -53,17 +54,41 @@ export class SourcesRuntime {
     });
   }
 
-  /** TMDB:优先注入;否则读环境变量 TMDB_API_KEY / TMDB_ACCESS_TOKEN(W2-A 设置页接管前的过渡) */
-  tmdb(): TmdbClient | null {
-    if (this.tmdbClient !== undefined) return this.tmdbClient;
+  /**
+   * TMDB 客户端:优先注入(测试);否则读设置 metadata.tmdbApiKeySecretRef(secret 现场解密)与 tmdbBaseUrl,
+   * 未配置时回退环境变量 TMDB_API_KEY / TMDB_ACCESS_TOKEN / TMDB_BASE_URL。设置变化(引用/地址)时重建。
+   */
+  async tmdb(): Promise<TmdbClient | null> {
     if (this.overrides.tmdb) {
-      this.tmdbClient = this.overrides.tmdb();
+      if (this.tmdbClient === undefined) this.tmdbClient = this.overrides.tmdb();
       return this.tmdbClient;
     }
+    const meta = await this.ctx.settings.get("metadata").catch(() => null);
     const env = (k: string) => Deno.env.get(k);
-    const apiKey = env("TMDB_API_KEY");
-    const accessToken = env("TMDB_ACCESS_TOKEN");
-    const baseUrl = env("TMDB_BASE_URL");
+    const ref = meta?.tmdbApiKeySecretRef ?? null;
+    const baseUrl = meta?.tmdbBaseUrl ?? env("TMDB_BASE_URL");
+    const sig = JSON.stringify([
+      ref,
+      baseUrl ?? null,
+      ref ? null : [!!env("TMDB_API_KEY"), !!env("TMDB_ACCESS_TOKEN")],
+    ]);
+    if (this.tmdbClient !== undefined && this.tmdbSig === sig) return this.tmdbClient;
+    let apiKey: string | undefined;
+    let accessToken: string | undefined;
+    if (ref) {
+      try {
+        const secret = (await this.ctx.secrets.resolve(ref)).trim();
+        // v3 API Key 是 32 位十六进制;其余(v4 read access token,JWT)走 Bearer
+        if (/^[0-9a-f]{32}$/i.test(secret)) apiKey = secret;
+        else accessToken = secret;
+      } catch (err) {
+        this.ctx.logger.warn({ err: { message: (err as Error).message } }, "TMDB 密钥解密失败,按未配置处理");
+      }
+    } else {
+      apiKey = env("TMDB_API_KEY");
+      accessToken = env("TMDB_ACCESS_TOKEN");
+    }
+    this.tmdbSig = sig;
     this.tmdbClient =
       apiKey || accessToken
         ? createTmdbClient({