feat(api): argon2 password, idempotent admin seed, api-exception infra

Task 12 + Task 7 quality-review carryovers:

Part A - password hashing & controlled initial admin:
- src/auth/password.ts: hashPassword/verifyPassword over @node-rs/argon2
  (napi prebuilt, argon2id default); empty plain rejected at the door
- src/scripts/seed-admin.ts: idempotent admin seed (ADMIN_ACCOUNT/
  ADMIN_PASSWORD env, walk-up root .env load); existing account -> skip,
  never overwrites the password; no audit_logs (system op, no actor)
- pnpm seed script (build + node dist/scripts/seed-admin.js);
  .env.example dev defaults admin/admin-secret-change-me
- tests: test/password.spec.ts (5), test/seed.spec.ts real-DB idempotency (4)

Part B - Task 7 carryovers (all 8):
- ApiException(apiCode, message, httpStatus, details?) recognized first by
  the filter; unmapped-status rule: >=500 -> INTERNAL_ERROR + generic
  message, <500 -> VALIDATION_FAILED keeping original status (warn-logged)
- 5xx/INTERNAL_ERROR responses forced to generic message (leak fix)
- pino redact adds req.headers.cookie / res.headers.set-cookie
- x-request-id echo capped at 128 chars (fresh UUID beyond, no log)
- LOG_LEVEL validated against pino levels at module wiring -> fail fast
- shared/ constants (API_PREFIX), request-with-id, log-level (+spec)
- jest ts-jest reuses tsconfig.json; unit testMatch includes test/*.spec.ts
- build:watch script (no concurrently dep; dev = build:watch + node --watch)

api: 35 unit + 10 e2e tests green; root lint/typecheck/test green.

Co-Authored-By: Claude Code <noreply@anthropic.com>

services/api/src/shared/constants.ts

@@ -0,0 +1,3 @@
+// services/api/src/shared/constants.ts —— 跨层共享常量（Task 7 遗留项⑥：
+// 此前 'v1' 前缀在 main-cn 与 e2e spec 各写一份，漂移风险集中到此处消除）。
+export const API_PREFIX = 'v1';

services/api/src/shared/log-level.spec.ts

@@ -0,0 +1,17 @@
+// services/api/src/shared/log-level.spec.ts —— LOG_LEVEL 校验单测。
+import { resolveLogLevel, VALID_LOG_LEVELS } from './log-level';
+
+describe('resolveLogLevel', () => {
+  it('defaults to info when unset', () => {
+    expect(resolveLogLevel(undefined)).toBe('info');
+  });
+
+  it.each([...VALID_LOG_LEVELS])('accepts built-in pino level %s', (level) => {
+    expect(resolveLogLevel(level)).toBe(level);
+  });
+
+  it('rejects an invalid level with a message listing valid values', () => {
+    expect(() => resolveLogLevel('verbose')).toThrow(/LOG_LEVEL.*verbose/);
+    expect(() => resolveLogLevel('')).toThrow(/fatal/);
+  });
+});

services/api/src/shared/log-level.ts

@@ -0,0 +1,29 @@
+// services/api/src/shared/log-level.ts —— LOG_LEVEL 启动期校验（Task 7 遗留项⑤）。
+// 此前非法 LOG_LEVEL 由 pino 在首次写日志时才隐式抛错（或更糟：被当成自定义
+// level 静默吞掉全部输出）。改为模块装配（LoggerModule.forRoot 前）即快速失败，
+// 错误信息列出全部合法值。合法值即 pino 内建 level 集合（pino.Level 类型）。
+import type { Level } from 'pino';
+
+export const VALID_LOG_LEVELS: readonly Level[] = [
+  'fatal',
+  'error',
+  'warn',
+  'info',
+  'debug',
+  'trace',
+];
+
+/**
+ * 解析进程环境 LOG_LEVEL：缺省 'info'；非法值抛错（调用点在模块装配期，
+ * 即应用启动即失败，不带半残日志配置上线）。
+ */
+export function resolveLogLevel(raw: string | undefined): Level {
+  const level = raw ?? 'info';
+  if (!VALID_LOG_LEVELS.includes(level as Level)) {
+    throw new Error(
+      `Invalid LOG_LEVEL "${level}". Valid levels: ${VALID_LOG_LEVELS.join(', ')} ` +
+        '(see .env.example).',
+    );
+  }
+  return level as Level;
+}

services/api/src/shared/request-with-id.ts

@@ -0,0 +1,14 @@
+// services/api/src/shared/request-with-id.ts —— 请求对象带 req.id 的共享类型
+// （Task 7 遗留项⑥）：request-id 中间件 / pino-http genReqId 写入，异常过滤器、
+// 后续 auth guard（req.user）等读取。此前在过滤器与中间件各声明一份局部接口。
+// 注意不继承 IncomingMessage：pino-http 经 module augmentation 给后者挂了
+// 非可选的 id: ReqId，扩展会与其冲突；组合用 ServerRequestWithId。
+import type { IncomingMessage } from 'node:http';
+
+/** 请求 ID 字段约定：上游 x-request-id 透传或 UUID v4（见 request-id.middleware.ts）。 */
+export interface RequestWithId {
+  id?: string;
+}
+
+/** 中间件/genReqId 实际操作的请求对象（node 原始请求 + id 字段）。 */
+export type ServerRequestWithId = IncomingMessage & RequestWithId;