feat(server): W2-A login gate, secrets, settings, instances, audit, engine panel API and PG-backed SSE bus

- Admin login gate (docs/design/auth-reference.md): admin_user/admin_session/login_attempt
  (migration 0015), one-time setup token logged once + conditional UPDATE, argon2id via
  hash-wasm (WASM; compiled binary has no --allow-ffi), sha256-stored sessions in HttpOnly
  SameSite=Lax cookie umt_session (fixed 12h TTL, soft revoke), HMAC-derived double-submit
  CSRF, IP (5) + account (15) failure limits per 15 min, password change revokes other
  sessions, optional TOTP with replay counter, AuditAction enum.
- Unified auth middleware: cookie session or Bearer API key -> c.var.actor
  {type: admin|api_key, id, name, scopes}; requireScope works for both; requireAdminSession.
- ctx.secrets: AES-256-GCM, per-secret HKDF-SHA256 key from SECRET_MASTER_KEY, AAD bound
  to (id, purpose); ctx.settings: 30s cache invalidated by settings.changed events.
- Endpoints: /auth/*, /settings, /api-keys, /secrets, /audit-events, library-roots,
  downloader/media-server instances (+test), path-mappings (+verify),
  PUT /sites/{id}/credentials, /engine/runs|stats|cancel (read-only openworkflow schema).
- SSE: PgEventBus (sse_event table, migration 0016, LISTEN/NOTIFY umt_events, catch-up by
  seq, pruning, resync); EventBusPort is now async.
- Tests: login/rate limit/revocation/CSRF/TOTP, secrets round trip and no log leakage,
  admin APIs against mock qB/Emby, SSE across two Deno subprocesses.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

apps/server/test/sse.test.ts

@@ -5,11 +5,11 @@ import { DEV_KEY, testApp } from "./helpers.ts";
 describe("EventBus", () => {
   it("序号自增并按 after 补读,淘汰后标记 gap", () => {
     const bus = new EventBus(3);
-    for (let i = 0; i < 5; i++) bus.publish("t", { i });
+    for (let i = 0; i < 5; i++) bus.publishSync("t", { i });
     expect(bus.latestSeq).toBe(5);
-    expect(bus.since(3).events.map((e) => e.seq)).toEqual([4, 5]);
-    expect(bus.since(3).gap).toBe(false);
-    expect(bus.since(1).gap).toBe(true);
+    expect(bus.sinceSync(3).events.map((e) => e.seq)).toEqual([4, 5]);
+    expect(bus.sinceSync(3).gap).toBe(false);
+    expect(bus.sinceSync(1).gap).toBe(true);
   });
 });
 
@@ -21,8 +21,8 @@ describe("GET /api/v1/events", () => {
 
   it("补读 after 之后的事件", async () => {
     const { app, bus } = testApp();
-    bus.publish("a", 1);
-    bus.publish("b", 2);
+    bus.publishSync("a", 1);
+    bus.publishSync("b", 2);
     const ac = new AbortController();
     const res = await app.request("/api/v1/events?after=1", {
       headers: { Authorization: `Bearer ${DEV_KEY}` },