feat(api): 搭建 API 与 Worker 骨架及契约基线

NestJS 11 + Fastify 统一错误体与 trace_id，/health 真实探活 DB/Redis，OpenAPI 3.1 契约含 20 个错误码；shared 包提供错误码、权限点、ULID、分页与通用 schema；worker 完成队列进程骨架。

packages/shared/src/permissions.spec.ts

@@ -0,0 +1,42 @@
+import { describe, expect, it } from 'vitest';
+
+import {
+  isPermissionCode,
+  parsePermission,
+  Permission,
+  PERMISSION_CODES,
+  SPECIAL_PERMISSIONS,
+} from './permissions.js';
+
+describe('权限点常量', () => {
+  it('全部符合 模块:动作 命名且模块为小写', () => {
+    for (const code of PERMISSION_CODES) {
+      expect(code).toMatch(/^[a-z][a-z_]*:[a-z][a-z_]*$/);
+      expect(parsePermission(code)).not.toBeNull();
+    }
+  });
+
+  it('特殊权限必须是已登记的权限点', () => {
+    for (const code of SPECIAL_PERMISSIONS) {
+      expect(PERMISSION_CODES).toContain(code);
+    }
+  });
+
+  it('isPermissionCode 只认可登记值', () => {
+    expect(isPermissionCode(Permission.SCRIPT_READ)).toBe(true);
+    expect(isPermissionCode('script:delete_all')).toBe(false);
+  });
+});
+
+describe('parsePermission', () => {
+  it('拆分模块与动作', () => {
+    expect(parsePermission('material:render')).toEqual({ module: 'material', action: 'render' });
+  });
+
+  it('非法格式返回 null', () => {
+    expect(parsePermission('scriptread')).toBeNull();
+    expect(parsePermission(':read')).toBeNull();
+    expect(parsePermission('script:')).toBeNull();
+    expect(parsePermission('a:b:c')).toBeNull();
+  });
+});