chore(ci): request-id, RBAC stats, web-тесты и гигиена CI

- genReqId (uuid) + x-request-id в каждом ответе и request_id в error
  envelope — корреляция ошибок между клиентом и логами
- RBAC: /agents/:id/(stats|blocked-ips|blocked-ports) классифицируются
  как fw:stats:read (reset остаётся под fw:agents:write)
- web: test-скрипт + 10 unit-тестов (filter-utils, fleet-kpis, parseClaims, nav)
- typecheck-скрипты для api/shared/db; CI: тесты shared и web, typecheck
  всех пакетов
- гигиена: .node-version (22), актуальный .dockerignore, drizzle out →
  ./migrations, удалены 12 лишних .gitkeep и пустой apps/api/test

apps/api/package.json

@@ -5,6 +5,7 @@
   "type": "module",
   "scripts": {
     "dev": "tsx watch src/server.ts",
+    "typecheck": "tsc --noEmit",
     "build": "tsup src/server.ts --format esm --dts --publicDir src/agent-scripts && node -e \"const fs=require('fs');const p='dist/agent-scripts';fs.mkdirSync(p,{recursive:true});for(const f of fs.readdirSync('src/agent-scripts'))fs.copyFileSync('src/agent-scripts/'+f,p+'/'+f)\"",
     "start": "node dist/server.js",
     "test": "vitest run"

apps/api/src/app.ts

@@ -33,8 +33,14 @@ export async function buildApp(opts: BuildAppOptions = {}) {
 
   const app = Fastify({
     logger: { level: config.logLevel },
+    genReqId: () => crypto.randomUUID(),
   }).withTypeProvider<ZodTypeProvider>()
 
+  // Correlation id in every response and in the error envelope.
+  app.addHook('onSend', async (req, reply) => {
+    reply.header('x-request-id', req.id)
+  })
+
   app.setValidatorCompiler(validatorCompiler)
   app.setSerializerCompiler(serializerCompiler)
 

apps/api/src/plugins/error-handler.ts

@@ -14,17 +14,25 @@ export class AppError extends Error {
 }
 
 async function errorHandlerPlugin(app: FastifyInstance) {
-  app.setErrorHandler((err, _req, reply) => {
+  app.setErrorHandler((err, req, reply) => {
     if (err instanceof AppError) {
       return reply.code(err.statusCode).send({
-        error: { code: err.code, message: err.message },
+        error: {
+          code: err.code,
+          message: err.message,
+          request_id: String(req.id),
+        },
       })
     }
     if (err instanceof ZodError) {
       const message =
         err.issues.map((i) => i.message).join('; ') || 'Validation error'
       return reply.code(400).send({
-        error: { code: 'VALIDATION_ERROR', message },
+        error: {
+          code: 'VALIDATION_ERROR',
+          message,
+          request_id: String(req.id),
+        },
       })
     }
     const e = err as { statusCode?: number; message?: string }
@@ -38,6 +46,7 @@ async function errorHandlerPlugin(app: FastifyInstance) {
       error: {
         code: status >= 500 ? 'INTERNAL_ERROR' : 'VALIDATION_ERROR',
         message,
+        request_id: String(req.id),
       },
     })
   })

apps/api/src/services/agents-policy.test.ts

@@ -15,6 +15,7 @@ const testConfig: AppConfig = {
   publicBaseUrl: 'https://fw.example.com',
   enrollSeed: 'test-seed',
   corsOrigins: [],
+  authAuditIngestSecret: null,
   secretKey: null,
   statsRetentionDays: 30,
 }

apps/api/src/services/bulk-ops.test.ts

@@ -15,6 +15,7 @@ const testConfig: AppConfig = {
   publicBaseUrl: 'https://fw.example.com',
   enrollSeed: 'test-seed',
   corsOrigins: [],
+  authAuditIngestSecret: null,
   secretKey: null,
   statsRetentionDays: 30,
 }

apps/api/src/services/install-links.test.ts

@@ -15,6 +15,7 @@ const testConfig: AppConfig = {
   publicBaseUrl: 'https://fw.example.com',
   enrollSeed: 'test-seed',
   corsOrigins: [],
+  authAuditIngestSecret: null,
   secretKey: null,
   statsRetentionDays: 30,
 }

apps/api/src/services/ip-block-stats.test.ts

@@ -15,6 +15,7 @@ const testConfig: AppConfig = {
   publicBaseUrl: 'https://fw.example.com',
   enrollSeed: 'test-seed',
   corsOrigins: [],
+  authAuditIngestSecret: null,
   secretKey: null,
   statsRetentionDays: 30,
 }

apps/api/src/services/policy/policy-mode.test.ts

@@ -15,6 +15,7 @@ const testConfig: AppConfig = {
   publicBaseUrl: 'https://fw.example.com',
   enrollSeed: 'test-seed',
   corsOrigins: [],
+  authAuditIngestSecret: null,
   secretKey: null,
   statsRetentionDays: 30,
 }

apps/api/src/services/port-acl.test.ts

@@ -15,6 +15,7 @@ const testConfig: AppConfig = {
   publicBaseUrl: 'https://fw.example.com',
   enrollSeed: 'test-seed',
   corsOrigins: [],
+  authAuditIngestSecret: null,
   secretKey: null,
   statsRetentionDays: 30,
 }

apps/api/src/services/retention-pagination.test.ts

@@ -16,6 +16,7 @@ const testConfig: AppConfig = {
   publicBaseUrl: 'https://fw.example.com',
   enrollSeed: 'test-seed',
   corsOrigins: [],
+  authAuditIngestSecret: null,
   secretKey: null,
   statsRetentionDays: 30,
 }

apps/api/src/services/settings-bump.test.ts

@@ -16,6 +16,7 @@ const testConfig: AppConfig = {
   publicBaseUrl: 'https://fw.example.com',
   enrollSeed: 'test-seed',
   corsOrigins: [],
+  authAuditIngestSecret: null,
   secretKey: null,
   statsRetentionDays: 30,
 }