chore(ci): request-id, RBAC stats, web-тесты и гигиена CI

- genReqId (uuid) + x-request-id в каждом ответе и request_id в error
  envelope — корреляция ошибок между клиентом и логами
- RBAC: /agents/:id/(stats|blocked-ips|blocked-ports) классифицируются
  как fw:stats:read (reset остаётся под fw:agents:write)
- web: test-скрипт + 10 unit-тестов (filter-utils, fleet-kpis, parseClaims, nav)
- typecheck-скрипты для api/shared/db; CI: тесты shared и web, typecheck
  всех пакетов
- гигиена: .node-version (22), актуальный .dockerignore, drizzle out →
  ./migrations, удалены 12 лишних .gitkeep и пустой apps/api/test

apps/api/src/services/agents-policy.test.ts

@@ -15,6 +15,7 @@ const testConfig: AppConfig = {
   publicBaseUrl: 'https://fw.example.com',
   enrollSeed: 'test-seed',
   corsOrigins: [],
+  authAuditIngestSecret: null,
   secretKey: null,
   statsRetentionDays: 30,
 }

apps/api/src/services/bulk-ops.test.ts

@@ -15,6 +15,7 @@ const testConfig: AppConfig = {
   publicBaseUrl: 'https://fw.example.com',
   enrollSeed: 'test-seed',
   corsOrigins: [],
+  authAuditIngestSecret: null,
   secretKey: null,
   statsRetentionDays: 30,
 }

apps/api/src/services/install-links.test.ts

@@ -15,6 +15,7 @@ const testConfig: AppConfig = {
   publicBaseUrl: 'https://fw.example.com',
   enrollSeed: 'test-seed',
   corsOrigins: [],
+  authAuditIngestSecret: null,
   secretKey: null,
   statsRetentionDays: 30,
 }

apps/api/src/services/ip-block-stats.test.ts

@@ -15,6 +15,7 @@ const testConfig: AppConfig = {
   publicBaseUrl: 'https://fw.example.com',
   enrollSeed: 'test-seed',
   corsOrigins: [],
+  authAuditIngestSecret: null,
   secretKey: null,
   statsRetentionDays: 30,
 }

apps/api/src/services/policy/policy-mode.test.ts

@@ -15,6 +15,7 @@ const testConfig: AppConfig = {
   publicBaseUrl: 'https://fw.example.com',
   enrollSeed: 'test-seed',
   corsOrigins: [],
+  authAuditIngestSecret: null,
   secretKey: null,
   statsRetentionDays: 30,
 }

apps/api/src/services/port-acl.test.ts

@@ -15,6 +15,7 @@ const testConfig: AppConfig = {
   publicBaseUrl: 'https://fw.example.com',
   enrollSeed: 'test-seed',
   corsOrigins: [],
+  authAuditIngestSecret: null,
   secretKey: null,
   statsRetentionDays: 30,
 }

apps/api/src/services/retention-pagination.test.ts

@@ -16,6 +16,7 @@ const testConfig: AppConfig = {
   publicBaseUrl: 'https://fw.example.com',
   enrollSeed: 'test-seed',
   corsOrigins: [],
+  authAuditIngestSecret: null,
   secretKey: null,
   statsRetentionDays: 30,
 }

apps/api/src/services/settings-bump.test.ts

@@ -16,6 +16,7 @@ const testConfig: AppConfig = {
   publicBaseUrl: 'https://fw.example.com',
   enrollSeed: 'test-seed',
   corsOrigins: [],
+  authAuditIngestSecret: null,
   secretKey: null,
   statsRetentionDays: 30,
 }