Merge branch 'ia2'

Co-Authored-By: Claude Fable 5.1 <[email protected]>

# Conflicts:
#	CHANGELOG.md
#	docs/plan/00-first-version-plan.md
#	packages/agent/src/system-prompt.ts

packages/contracts/test/db-sync.test.ts

@@ -77,8 +77,8 @@ const ROWS: Record<string, { row: Obj; dbOnly?: string[]; apiOnly?: string[] }>
   Secret: { row: C.Secret, dbOnly: ["ciphertext", "nonce", "authTag"] },
   ServerMapping: { row: C.ServerMapping },
   Settings: { row: C.SettingEntry },
-  // deleted_at:软删除只在服务端过滤(已删站点不出 API)
-  Site: { row: C.Site, dbOnly: ["deletedAt"] },
+  // deleted_at:软删除只在服务端过滤(已删站点不出 API);capabilities 由类型 ∩ 站点定义算出(IA-2)
+  Site: { row: C.Site, dbOnly: ["deletedAt"], apiOnly: ["capabilities"] },
   // secret 引用不外露,只给布尔
   SiteUserData: { row: C.SiteUserData },
   SiteAccount: {
@@ -248,6 +248,7 @@ const ENUMS: Record<string, z.ZodEnum> = {
   SiteAdapter: C.SiteAdapter,
   SiteHealthStatus: C.SiteHealth,
   SiteCircuitState: C.CircuitState,
+  SiteKind: C.SiteKind,
   SiteAccountAuthKind: C.SiteAuthKind,
   SiteAccountStatus: C.SiteAccountStatus,
   SourceReleaseResolutionStatus: C.ResolutionStatus,