chore: scaffold monorepo and migrate uhd_web design system (W0-A)

- pnpm workspace: apps/{web,server}, packages/{contracts,db,domain,adapters,tasks,agent,testkit}
- server: Hono + zod-openapi, API Key auth with scopes, redacting pino logger, SSE event bus with replay, worker heartbeat
- db: Kysely + pg, file migrator, 0001_init (settings/api_key/audit_event/outbox_event)
- web: React Router 7 SPA console shell with 12 workspace placeholders, uhd_web tokens/ui/guard scripts
- docs: ADR-001 (Node over Deno), dev runbook, design system rules

Co-Authored-By: Claude Fable 5.1 <[email protected]>

apps/server/test/logger.test.ts

@@ -0,0 +1,28 @@
+import { describe, expect, it } from "vitest";
+import { redact, redactString } from "../src/logger";
+import { memoryLogger } from "./helpers";
+
+describe("日志脱敏", () => {
+  it("URL query 中的 passkey/token 被替换", () => {
+    expect(redactString("https://pt.example/rss?passkey=abc123&x=1")).toBe(
+      "https://pt.example/rss?passkey=[REDACTED]&x=1",
+    );
+    expect(redactString("/dl?id=1&token=zzz")).toBe("/dl?id=1&token=[REDACTED]");
+  });
+
+  it("敏感字段整体替换,数值计数保留", () => {
+    expect(redact({ cookie: "a=b", nested: { Authorization: "Bearer x", password: "p" }, inputTokens: 12 })).toEqual({
+      cookie: "[REDACTED]",
+      nested: { Authorization: "[REDACTED]", password: "[REDACTED]" },
+      inputTokens: 12,
+    });
+  });
+
+  it("logger 输出不含明文", () => {
+    const { logger, lines } = memoryLogger();
+    logger.info({ url: "https://x/rss?passkey=SECRET1", token: "SECRET2" }, "fetch https://y/?token=SECRET3");
+    logger.error({ err: new Error("GET https://x/dl?passkey=SECRET4 failed") }, "boom");
+    const out = lines.join("");
+    for (const s of ["SECRET1", "SECRET2", "SECRET3", "SECRET4"]) expect(out).not.toContain(s);
+  });
+});