feat(server): W2-B sources, identity resolution, metadata and site workbench

- Sites / accounts / feeds: registry view (/site-definitions), site CRUD with
  enable/disable (history stays queryable, marked site_disabled), accounts and
  feed URLs stored as secrets (only secret_ref / redacted urlDisplay exposed),
  feed enable/disable/reset/fetch; one shared rate limiter + adapter per site.
- Tasks: ingestFeed (FeedFetchState/FeedCursor on feed_source, observation
  feed+guid upsert with digest-change updates, source_release site+id
  aggregation across feeds, auth failure -> account invalid + decision, no
  retry, gap -> feed.gap_suspected -> budgeted backfill snapshot),
  resolveObservation (parseRelease -> local recall via title_alias pg_trgm +
  accepted identities -> TMDB -> resolveIdentity; auto binds entity /
  provisional units / identities / aliases, otherwise identity_candidate pool
  with evidence version and bounded review backoff; manual lock respected),
  refreshMetadata (metadata_field + field_override, user locks win, paths
  untouched), snapshotSite (site_snapshot coverage records).
- Events: feed.due, feed.gap_suspected, release.observed (self-consumed),
  release.resolved, decision.created/updated; scheduler in worker start().
- Identity API: entity detail with redirects, manual mapping correction with
  identity_revision, merge with identity_redirect, pool list/assign/dismiss/
  retry, content unit numbering lock, aliases, external identities.
- Decisions: list/summary (by entity and kind)/detail/resolve; identity
  options executed directly.
- Workbench: /sites/{id}/releases (snapshot first, coalesced live search with
  backoff, origin + freshness) and /sites/{id}/releases/{rid} (volatile field
  recheck times, refresh keeps data on failure).
- Capabilities: catalog.lookup, release.search, release.inspect,
  identity.resolve.
- Migrations 0018-0020: site.adapter api, source_release.resolution_locked,
  site_snapshot, identity_candidate, resolution_attempt, identity_redirect,
  metadata_field, field_override.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

packages/contracts/test/db-sync.test.ts

@@ -79,6 +79,13 @@ const ROWS: Record<string, { row: Obj; dbOnly?: string[]; apiOnly?: string[] }>
   Subscription: { row: C.Subscription },
   Task: { row: C.Task },
   TitleAlias: { row: C.TitleAlias },
+  // W2-B 来源/身份/元数据(0018–0020)
+  FieldOverride: { row: C.FieldOverride },
+  IdentityCandidate: { row: C.IdentityCandidate },
+  IdentityRedirect: { row: C.IdentityRedirect },
+  MetadataField: { row: C.MetadataField },
+  ResolutionAttempt: { row: C.ResolutionAttempt },
+  SiteSnapshot: { row: C.SiteSnapshot },
 };
 
 /** 引擎自有表(@umt/tasks 内部使用,不经 API 暴露),不要求 Row schema */
@@ -186,6 +193,17 @@ const ENUMS: Record<string, z.ZodEnum> = {
   TaskStatus: C.TaskStatus,
   TitleAliasKind: C.AliasKind,
   TitleAliasSource: C.AliasSource,
+  // W2-B(0018–0020)
+  FieldOverrideSource: C.MetadataSource,
+  FieldOverrideActorType: C.ActorType,
+  IdentityCandidateStatus: C.IdentityCandidateStatus,
+  IdentityCandidateReason: C.IdentityCandidateReason,
+  IdentityRedirectActorType: C.ActorType,
+  MetadataFieldSource: C.MetadataSource,
+  ResolutionAttemptOutcome: C.ResolutionOutcome,
+  ResolutionAttemptActorType: C.ActorType,
+  SiteSnapshotKind: C.SiteSnapshotKind,
+  SiteSnapshotStatus: C.SiteSnapshotStatus,
 };
 
 describe("contracts ⇔ db 表结构同步", () => {