feat(blueprints): backend foundation for fleet-wide compose templates (#860)

* feat(blueprints): add backend foundation for fleet-wide compose templates

Introduces the Blueprint Model: a docker-compose.yml plus a node selector
(labels or explicit IDs) that Sencho reconciles across the fleet. Backend
foundation only; the frontend tab and documentation follow.

Schema (DatabaseService):
- node_labels table for fleet-level orchestration tagging
- blueprints table with compose content, selector, drift_mode, classification
- blueprint_deployments table for per-node materialized state
- New idempotent migrate methods following the existing pattern

Services:
- BlueprintAnalyzer: pure compose-YAML classifier (stateless / stateful /
  unknown) with 17 covered cases including named volumes, bind mounts,
  external volumes, and tmpfs
- NodeLabelService: label CRUD plus selector matching helper (any/all/ids)
- BlueprintService: local + remote deploy/withdraw orchestration, marker
  file management, name-conflict guard, per-(blueprint,node) lock
- BlueprintReconciler: 60-second loop with three-mode drift policy
  (observe/suggest/enforce), state-aware guards, and Enforce-downgrade for
  volume-destroying drift

Routes (gated requirePaid + requireAdmin on mutations):
- /api/blueprints (CRUD + apply + withdraw + accept + preview + analyze)
- /api/node-labels (CRUD + listAll + listDistinct)

Notifications: four new categories registered in NotificationService for
deploy/failure/drift events.

Bootstrap: reconciler start/stop wired in startup and shutdown.

Tests: 45 new Vitest cases covering selector matching, classifier rules,
state-aware guards, drift-mode branching, and marker parsing. Full backend
suite (1625 tests) passes; tsc clean.

* fix(lint): replace bare Function type in blueprint reconciler tests

Replace 8 occurrences of `as unknown as { computeDecision: Function }`
with a properly typed `ReconcilerWithCompute` alias that mirrors the
real method signature. Export `ReconcileDecision` from
BlueprintReconciler so the test can reference it.

Resolves @typescript-eslint/no-unsafe-function-type errors that were
failing the Backend (Lint) CI step.

backend/src/index.ts

@@ -10,6 +10,8 @@ import { attachUpgrade } from './websocket/upgradeHandler';
 import { startServer } from './bootstrap/startup';
 import { installShutdownHandlers } from './bootstrap/shutdown';
 import { metaRouter } from './routes/meta';
+import { blueprintsRouter } from './routes/blueprints';
+import { nodeLabelsRouter } from './routes/nodeLabels';
 import { authRouter } from './routes/auth';
 import { mfaRouter } from './routes/mfa';
 import { ssoRouter } from './routes/sso';
@@ -103,6 +105,8 @@ app.use('/api/stacks', stackGitSourceRouter);
 app.use('/api/settings', settingsRouter);
 app.use('/api/scheduled-tasks', scheduledTasksRouter);
 app.use('/api/mesh', meshRouter);
+app.use('/api/blueprints', blueprintsRouter);
+app.use('/api/node-labels', nodeLabelsRouter);
 app.use('/api/agents', agentsRouter);
 app.use('/api', metricsRouter);
 app.use('/api/image-updates', imageUpdatesRouter);