feat(server): W2-A login gate, secrets, settings, instances, audit, engine panel API and PG-backed SSE bus

- Admin login gate (docs/design/auth-reference.md): admin_user/admin_session/login_attempt
  (migration 0015), one-time setup token logged once + conditional UPDATE, argon2id via
  hash-wasm (WASM; compiled binary has no --allow-ffi), sha256-stored sessions in HttpOnly
  SameSite=Lax cookie umt_session (fixed 12h TTL, soft revoke), HMAC-derived double-submit
  CSRF, IP (5) + account (15) failure limits per 15 min, password change revokes other
  sessions, optional TOTP with replay counter, AuditAction enum.
- Unified auth middleware: cookie session or Bearer API key -> c.var.actor
  {type: admin|api_key, id, name, scopes}; requireScope works for both; requireAdminSession.
- ctx.secrets: AES-256-GCM, per-secret HKDF-SHA256 key from SECRET_MASTER_KEY, AAD bound
  to (id, purpose); ctx.settings: 30s cache invalidated by settings.changed events.
- Endpoints: /auth/*, /settings, /api-keys, /secrets, /audit-events, library-roots,
  downloader/media-server instances (+test), path-mappings (+verify),
  PUT /sites/{id}/credentials, /engine/runs|stats|cancel (read-only openworkflow schema).
- SSE: PgEventBus (sse_event table, migration 0016, LISTEN/NOTIFY umt_events, catch-up by
  seq, pruning, resync); EventBusPort is now async.
- Tests: login/rate limit/revocation/CSRF/TOTP, secrets round trip and no log leakage,
  admin APIs against mock qB/Emby, SSE across two Deno subprocesses.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

apps/server/test/bootstrap.test.ts

@@ -10,6 +10,7 @@ import { type Bootstrapped, bootstrap } from "../src/context.ts";
 import { EventBus } from "../src/http/sse.ts";
 import type { ServerModule } from "../src/modules/types.ts";
 import { type RunningWorker, startWorker } from "../src/worker/index.ts";
+import { withSchemaLock } from "./auth-settings/harness.ts";
 import { memoryLogger } from "./helpers.ts";
 
 // 真实 PG:独立业务 schema + 独立引擎 schema,验证 bootstrap → worker → outbox → 模块任务 的整条装配。
@@ -71,7 +72,7 @@ describe.skipIf(!hasPg)("bootstrap + worker(真实 PG)", () => {
         pool: new pg.Pool({ connectionString: url, max: 5, options: `-c search_path=${biz},public` }),
       }),
     });
-    await migrateToLatest(db, { migrationTableSchema: biz });
+    await withSchemaLock(() => migrateToLatest(db, { migrationTableSchema: biz }));
     await db
       .insertInto("settings")
       .values({ key: "cache", value: JSON.stringify({ hardThresholdPercent: 95, resumePercent: 90 }) })
@@ -98,18 +99,20 @@ describe.skipIf(!hasPg)("bootstrap + worker(真实 PG)", () => {
     await worker?.stop();
     await booted?.engine.stop();
     await db?.destroy();
-    const admin = new pg.Client({ connectionString: url });
-    await admin.connect();
-    await admin.query(`drop schema if exists ${biz} cascade`);
-    await admin.query(`drop schema if exists ${ow} cascade`);
-    await admin.end();
+    await withSchemaLock(async () => {
+      const admin = new pg.Client({ connectionString: url });
+      await admin.connect();
+      await admin.query(`drop schema if exists ${biz} cascade`);
+      await admin.query(`drop schema if exists ${ow} cascade`);
+      await admin.end();
+    });
   }, 60_000);
 
   it("settings 读取合并缺省值", async () => {
     const cache = await booted.ctx.settings.get("cache");
     expect(cache).toMatchObject({ hardThresholdPercent: 95, resumePercent: 90, checkIntervalSec: 60 });
     expect((await booted.ctx.settings.all()).automation.enabled).toBe(true);
-    await expect(booted.ctx.secrets.resolve("x")).rejects.toThrow(/W2-A/);
+    await expect(booted.ctx.secrets.resolve("x")).rejects.toThrow(/不存在/);
   });
 
   it("业务事务内 emit → 中继路由 → worker 执行模块任务;同幂等键只投一次;非法 payload 拒写", async () => {