feat(server): ServerModule skeleton with shared ServerContext, worker runs engine + outbox relay (B6)

modules/{auth-settings,sources-identity,acquisition-organize,agent} placeholders listed in
SERVER_MODULES; ServerModule registers routes (under /api/v1, authenticated), tasks,
outbox routes, capabilities and background loops. bootstrap() builds ServerContext (db,
config, logger, events, engine, outbox writer, secrets placeholder, settings reader,
capability registry), fills unregistered tasks with stubs and rejects duplicate task or
outbox ownership. worker starts the OpenWorkflow worker, OutboxRelay and module start().
--role migrate also migrates the engine schema; api/worker connect without migrating.
tasks: TaskRegistry.has, migrateEngineSchema.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

apps/server/src/modules/auth-settings/provided.ts

@@ -0,0 +1,33 @@
+import { DEFAULT_SETTINGS, GlobalSettings, type SettingsKey } from "@umt/contracts";
+import type { DB, Kysely } from "@umt/db";
+import type { Logger } from "pino";
+import type { SecretStore, SettingsReader } from "../types.ts";
+
+// auth-settings 模块向 ServerContext 提供的基础服务。W2-A 在这里替换实现,其它模块只用 ctx 上的接口。
+
+/** 占位:W2-A 实现 AES-GCM 加密存取(secret 表,SECRET_MASTER_KEY) */
+export function createSecretStore(_deps: { db: Kysely<DB>; masterKey: string }): SecretStore {
+  const notYet = async (): Promise<never> => {
+    throw new Error("SecretStore 尚未实现(W2-A)");
+  };
+  return { resolve: notYet, create: notYet, replace: notYet, remove: notYet };
+}
+
+/** settings 表(key → jsonb)按分组合并缺省值;每次读库,不缓存(设置变更立即生效) */
+export function createSettingsReader(deps: { db: Kysely<DB>; logger: Logger }): SettingsReader {
+  const all = async (): Promise<GlobalSettings> => {
+    const rows = await deps.db.selectFrom("settings").select(["key", "value"]).execute();
+    const stored = new Map(rows.map((r) => [r.key, r.value]));
+    const out: Record<string, unknown> = {};
+    for (const key of Object.keys(DEFAULT_SETTINGS) as SettingsKey[]) {
+      const def = DEFAULT_SETTINGS[key];
+      const v = stored.get(key);
+      const merged = v && typeof v === "object" && !Array.isArray(v) ? { ...def, ...(v as object) } : def;
+      const parsed = GlobalSettings.shape[key].safeParse(merged);
+      if (!parsed.success) deps.logger.warn({ key }, "settings 值不合法,回退缺省");
+      out[key] = parsed.success ? parsed.data : def;
+    }
+    return out as GlobalSettings;
+  };
+  return { all, get: async (key) => (await all())[key] };
+}