chore: scaffold monorepo and migrate uhd_web design system (W0-A)

- pnpm workspace: apps/{web,server}, packages/{contracts,db,domain,adapters,tasks,agent,testkit}
- server: Hono + zod-openapi, API Key auth with scopes, redacting pino logger, SSE event bus with replay, worker heartbeat
- db: Kysely + pg, file migrator, 0001_init (settings/api_key/audit_event/outbox_event)
- web: React Router 7 SPA console shell with 12 workspace placeholders, uhd_web tokens/ui/guard scripts
- docs: ADR-001 (Node over Deno), dev runbook, design system rules

Co-Authored-By: Claude Fable 5.1 <[email protected]>

apps/server/src/http/routes/health.ts

@@ -0,0 +1,46 @@
+import { createRoute, OpenAPIHono } from "@hono/zod-openapi";
+import { apiResponse, HealthStatus } from "@umt/contracts";
+
+export interface HealthDeps {
+  version: string;
+  role: "api" | "worker" | "all";
+  startedAt: number;
+  /** 返回数据库是否可用;未配置时省略 */
+  pingDb?: () => Promise<boolean>;
+}
+
+const route = createRoute({
+  method: "get",
+  path: "/health",
+  tags: ["system"],
+  summary: "服务健康状态(免鉴权)",
+  responses: {
+    200: {
+      description: "服务状态",
+      content: { "application/json": { schema: apiResponse(HealthStatus) } },
+    },
+  },
+});
+
+export function healthRoutes(deps: HealthDeps) {
+  const app = new OpenAPIHono();
+  app.openapi(route, async (c) => {
+    let db: HealthStatus["db"] = "unknown";
+    if (deps.pingDb) {
+      db = await deps.pingDb().then(
+        (ok) => (ok ? "ok" : "down"),
+        () => "down" as const,
+      );
+    }
+    const data: HealthStatus = {
+      status: db === "down" ? "degraded" : "ok",
+      version: deps.version,
+      role: deps.role,
+      uptimeSec: Math.round((Date.now() - deps.startedAt) / 1000),
+      db,
+      time: new Date().toISOString(),
+    };
+    return c.json({ ok: true, data }, 200);
+  });
+  return app;
+}

apps/server/src/http/routes/openapi.ts

@@ -0,0 +1,18 @@
+import { swaggerUI } from "@hono/swagger-ui";
+import type { OpenAPIHono } from "@hono/zod-openapi";
+
+/** 挂载 /api/openapi.json 与 /api/docs */
+// biome-ignore lint/suspicious/noExplicitAny: 根 app 的 Env 泛型各异
+export function mountOpenApi(app: OpenAPIHono<any>, version: string) {
+  app.openAPIRegistry.registerComponent("securitySchemes", "bearerAuth", {
+    type: "http",
+    scheme: "bearer",
+    description: "API Key",
+  });
+  app.doc31("/api/openapi.json", {
+    openapi: "3.1.0",
+    info: { title: "UHD Media Tool API", version },
+    security: [{ bearerAuth: [] }],
+  });
+  app.get("/api/docs", swaggerUI({ url: "/api/openapi.json" }));
+}