chore(ci): request-id, RBAC stats, web-тесты и гигиена CI

- genReqId (uuid) + x-request-id в каждом ответе и request_id в error
  envelope — корреляция ошибок между клиентом и логами
- RBAC: /agents/:id/(stats|blocked-ips|blocked-ports) классифицируются
  как fw:stats:read (reset остаётся под fw:agents:write)
- web: test-скрипт + 10 unit-тестов (filter-utils, fleet-kpis, parseClaims, nav)
- typecheck-скрипты для api/shared/db; CI: тесты shared и web, typecheck
  всех пакетов
- гигиена: .node-version (22), актуальный .dockerignore, drizzle out →
  ./migrations, удалены 12 лишних .gitkeep и пустой apps/api/test

packages/db/drizzle.config.ts

@@ -2,7 +2,9 @@ import { defineConfig } from 'drizzle-kit'
 
 export default defineConfig({
   schema: './src/schema.ts',
-  out: './drizzle',
+  // Migration SQL files live here and are applied by the custom runner in
+  // src/client.ts (runMigrations); drizzle-kit generate adds new files to it.
+  out: './migrations',
   dialect: 'sqlite',
   dbCredentials: { url: 'data/app.db' },
 })

packages/db/package.json

@@ -12,6 +12,7 @@
     }
   },
   "scripts": {
+    "typecheck": "tsc --noEmit",
     "build": "tsup src/index.ts --format esm --dts",
     "dev": "tsup src/index.ts --format esm --dts --watch",
     "db:generate": "drizzle-kit generate",

packages/shared/package.json

@@ -12,6 +12,7 @@
     }
   },
   "scripts": {
+    "typecheck": "tsc --noEmit",
     "build": "tsup src/index.ts --format esm --dts",
     "dev": "tsup src/index.ts --format esm --dts --watch",
     "test": "vitest run --passWithNoTests"

packages/shared/src/permissions.test.ts

@@ -11,6 +11,20 @@ describe('permissionForRequest', () => {
     )
   })
 
+  it('maps agent stats endpoints to stats permission, not agents', () => {
+    expect(
+      permissionForRequest('GET', '/api/v1/agents/a1/stats'),
+    ).toBe('fw:stats:read')
+    expect(
+      permissionForRequest('GET', '/api/v1/agents/a1/blocked-ips'),
+    ).toBe('fw:stats:read')
+    // reset is destructive — stays under agents write
+    expect(
+      permissionForRequest('POST', '/api/v1/agents/a1/stats/reset'),
+    ).toBe('fw:agents:write')
+    expect(permissionForRequest('GET', '/api/v1/agents')).toBe('fw:agents:read')
+  })
+
   it('maps integrations to lists read / settings admin', () => {
     expect(
       permissionForRequest('GET', '/api/v1/integrations/evobgp/communities'),

packages/shared/src/permissions.ts

@@ -29,6 +29,12 @@ export function permissionForRequest(
   const m = method.toUpperCase()
   const write = m !== 'GET' && m !== 'HEAD' && m !== 'OPTIONS'
 
+  // Agent statistics live under /agents/:id/… — classify as stats, not agents.
+  if (
+    /^\/api\/v1\/agents\/[^/]+\/(stats|blocked-ips|blocked-ports)$/.test(path)
+  ) {
+    return 'fw:stats:read'
+  }
   if (path.startsWith('/api/v1/agents') || path.startsWith('/api/v1/install-links')) {
     return write ? 'fw:agents:write' : 'fw:agents:read'
   }