feat(api): argon2 password, idempotent admin seed, api-exception infra

Task 12 + Task 7 quality-review carryovers:

Part A - password hashing & controlled initial admin:
- src/auth/password.ts: hashPassword/verifyPassword over @node-rs/argon2
  (napi prebuilt, argon2id default); empty plain rejected at the door
- src/scripts/seed-admin.ts: idempotent admin seed (ADMIN_ACCOUNT/
  ADMIN_PASSWORD env, walk-up root .env load); existing account -> skip,
  never overwrites the password; no audit_logs (system op, no actor)
- pnpm seed script (build + node dist/scripts/seed-admin.js);
  .env.example dev defaults admin/admin-secret-change-me
- tests: test/password.spec.ts (5), test/seed.spec.ts real-DB idempotency (4)

Part B - Task 7 carryovers (all 8):
- ApiException(apiCode, message, httpStatus, details?) recognized first by
  the filter; unmapped-status rule: >=500 -> INTERNAL_ERROR + generic
  message, <500 -> VALIDATION_FAILED keeping original status (warn-logged)
- 5xx/INTERNAL_ERROR responses forced to generic message (leak fix)
- pino redact adds req.headers.cookie / res.headers.set-cookie
- x-request-id echo capped at 128 chars (fresh UUID beyond, no log)
- LOG_LEVEL validated against pino levels at module wiring -> fail fast
- shared/ constants (API_PREFIX), request-with-id, log-level (+spec)
- jest ts-jest reuses tsconfig.json; unit testMatch includes test/*.spec.ts
- build:watch script (no concurrently dep; dev = build:watch + node --watch)

api: 35 unit + 10 e2e tests green; root lint/typecheck/test green.

Co-Authored-By: Claude Code <noreply@anthropic.com>

services/api/src/app-cn.module.ts

@@ -12,6 +12,8 @@ import { AllExceptionsFilter } from './all-exceptions.filter';
 import { HealthController } from './health.controller';
 import { PrismaModule } from './prisma/prisma.module';
 import { RequestIdMiddleware, resolveRequestId } from './request-id.middleware';
+import { resolveLogLevel } from './shared/log-level';
+import type { ServerRequestWithId } from './shared/request-with-id';
 
 @Module({
   imports: [
@@ -22,12 +24,21 @@ import { RequestIdMiddleware, resolveRequestId } from './request-id.middleware';
         // 与 RequestIdMiddleware 共用同一解析函数：优先透传 x-request-id，
         // 其次复用已生成的 req.id，否则生成 UUID；并回写响应头。
         genReqId: (req: IncomingMessage, res: ServerResponse) =>
-          resolveRequestId(req, res),
+          resolveRequestId(req as ServerRequestWithId, res),
         redact: {
-          paths: ['req.headers.authorization', 'res.headers.authorization'],
+          // 授权头 + Cookie（会话凭据，Task 7 遗留项③）：请求/响应两侧都打码，
+          // 防止日志聚合层留存可重放的凭据。
+          paths: [
+            'req.headers.authorization',
+            'req.headers.cookie',
+            'res.headers.authorization',
+            'res.headers.set-cookie',
+          ],
           censor: '[REDACTED]',
         },
-        level: process.env.LOG_LEVEL ?? 'info',
+        // Task 7 遗留项⑤：非法 LOG_LEVEL 在模块装配期（即启动期）快速失败，
+        // 而不是让 pino 首次写日志时才炸或静默吞掉输出。
+        level: resolveLogLevel(process.env.LOG_LEVEL),
       },
     }),
   ],