feat(api): argon2 password, idempotent admin seed, api-exception infra

Task 12 + Task 7 quality-review carryovers:

Part A - password hashing & controlled initial admin:
- src/auth/password.ts: hashPassword/verifyPassword over @node-rs/argon2
  (napi prebuilt, argon2id default); empty plain rejected at the door
- src/scripts/seed-admin.ts: idempotent admin seed (ADMIN_ACCOUNT/
  ADMIN_PASSWORD env, walk-up root .env load); existing account -> skip,
  never overwrites the password; no audit_logs (system op, no actor)
- pnpm seed script (build + node dist/scripts/seed-admin.js);
  .env.example dev defaults admin/admin-secret-change-me
- tests: test/password.spec.ts (5), test/seed.spec.ts real-DB idempotency (4)

Part B - Task 7 carryovers (all 8):
- ApiException(apiCode, message, httpStatus, details?) recognized first by
  the filter; unmapped-status rule: >=500 -> INTERNAL_ERROR + generic
  message, <500 -> VALIDATION_FAILED keeping original status (warn-logged)
- 5xx/INTERNAL_ERROR responses forced to generic message (leak fix)
- pino redact adds req.headers.cookie / res.headers.set-cookie
- x-request-id echo capped at 128 chars (fresh UUID beyond, no log)
- LOG_LEVEL validated against pino levels at module wiring -> fail fast
- shared/ constants (API_PREFIX), request-with-id, log-level (+spec)
- jest ts-jest reuses tsconfig.json; unit testMatch includes test/*.spec.ts
- build:watch script (no concurrently dep; dev = build:watch + node --watch)

api: 35 unit + 10 e2e tests green; root lint/typecheck/test green.

Co-Authored-By: Claude Code <noreply@anthropic.com>

services/api/jest.config.ts

@@ -1,5 +1,6 @@
-// services/api/jest.config.ts —— 单测（*.spec.ts，排除 e2e）。
-// ts-jest 保持类型检查模式（非 isolatedModules），@ts-expect-error 负向断言可生效。
+// services/api/jest.config.ts —— 单测（src/*.spec.ts + test/*.spec.ts，排除 e2e）。
+// ts-jest 保持类型检查模式（非 isolatedModules），@ts-expect-error 负向断言可生效；
+// 编译选项复用包级 tsconfig.json（Task 7 遗留项：不再内联重复一份 compilerOptions）。
 // env 约定：setupFiles 经 test/load-env.ts 载入仓库根 .env（全仓库唯一 env 文件）。
 // ESM 互操作：@photo/contracts 为 ESM 包（NodeNext + .js 后缀导入），测试经
 // moduleNameMapper 直接指向其 TS 源码，由 ts-jest 以 CJS 编译（同
@@ -15,28 +16,16 @@ const config: Config = {
   rootDir: '.',
   setupFiles: ['./test/load-env.ts'],
   transform: {
-    '^.+\\.tsx?$': [
-      'ts-jest',
-      {
-        tsconfig: {
-          module: 'commonjs',
-          moduleResolution: 'node10',
-          target: 'es2022',
-          lib: ['es2022'],
-          strict: true,
-          esModuleInterop: true,
-          skipLibCheck: true,
-          types: ['node', 'jest'],
-        },
-      },
-    ],
+    '^.+\\.tsx?$': ['ts-jest', { tsconfig: 'tsconfig.json' }],
   },
   moduleNameMapper: {
     '^@photo/contracts$': '<rootDir>/../../packages/contracts/src/index.ts',
     '^@photo/db-cn$': '<rootDir>/../../packages/db-cn/src/index.ts',
     '^(\\.{1,2}/.*)\\.js$': '$1',
   },
-  testMatch: ['<rootDir>/src/**/*.spec.ts'],
+  // test/ 下的 *.spec.ts 为直连真实 DB 的集成型单测（seed.spec.ts，经 reset.ts
+  // 隔离）；纯 HTTP e2e 仍由 jest.e2e.config.ts 的 testMatch 接管。
+  testMatch: ['<rootDir>/src/**/*.spec.ts', '<rootDir>/test/**/*.spec.ts'],
   testPathIgnorePatterns: ['/node_modules/', '/dist/'],
 };