feat: prepare Rockets for 1.0 preview - #33

Why

Rockets promises a definition-first path from domain resources and auth integrations to a working Nest application. The 1.0-readiness review found package-boundary, authentication, repository, and release gaps that made the published surface less reliable than that promise.

This PR makes the runtime behavior and release evidence match the intended model: integrations carry what they own, request context survives every local CQRS/repository hop, local Firestore behavior matches the supported emulator contract, and the release gate proves both packages and runnable examples.

What changed

Definition-first composition

• Add createServer(definition) as the canonical Nest entry-module facade.
• Add defineAuthAdapter(Adapter, options?) for custom auth integrations.
• Let auth bootstraps contribute owned resources, metadata, repository setup, and guard preference; explicit application options still win and conflicting defaults fail fast.
• Make user metadata genuinely optional, including /me and its default CQRS handlers.
• Move defineTypeOrmRepository to the TypeORM adapter package and remove duplicated server/sample helpers.

Authentication and request context

• Own the recovery workflow inside Rockets while providing it under the upstream public RecoveryService token. This keeps upstream public policy/port contracts while fixing sequencing, context propagation, and awaited side effects without patching node_modules.
• Make recovery initiation enumeration-safe and remove sensitive email/passcode/stack data from logs.
• Validate a recovery passcode with POST /recovery/passcode and a request-body DTO; the former GET path is intentionally gone.
• Enforce a boolean false password-history result before any credential write.
• Complete password reset in the transaction, clear the OTP, then attempt the password-updated notification on a best-effort basis.
• Replace the duplicate repository-context helper with the canonical AppContextHost API and propagate context through local commands, queries, ports, OTP services, guards, JWT resolution, invitations, and background listeners.
• Keep auth defaults registered before consumer providers so overrides behave deterministically.

Firestore parity

• Share nested-field reads and supported scalar ordering across row filters, post-filters, and sorting.
• Distinguish a missing field from an explicit null, exclude cross-type range comparisons, and support structural equality for arrays, plain maps, bytes, dates, and SDK values exposing isEqual.
• Recursively normalize Firestore timestamps returned from the Admin backend.
• Add pure regression tests plus a Java-backed Firestore emulator contract comparing the Admin and in-memory backends.
• Remove the broad root path-to-regexp resolution because it forced Firebase CLI's Express 4 dependency onto an incompatible v8 API; package-specific dependency resolution now selects the correct versions.

Release and documentation readiness

• Rename TypeScript Vitest configs to .mts, use explicit .mts imports, and prove they load through Vitest's native config loader without the prior warning.
• Add a Node 20 / Java 21 release-readiness workflow and cache the Firestore emulator binary. Existing CI remains intact.
• Keep the emulator contract in release:check; run the native-config assertion in the Node 22 coverage job because Node 20 cannot execute .mts files through Vitest's native loader.
• Exclude emulator specs from compiled/published Firestore artifacts.
• Remove the checked-in generated auth Swagger snapshot and update routes, version notes, and ownership/context documentation.
• Keep @concepta/nestjs-common at 8.0.0-alpha.6: registry verification showed that is still its latest published v8 build, while the other available v8 modules are pinned to 8.0.0-alpha.8.

Failures reproduced and closed

• A password-history adapter returning false did not stop credential creation; the new regression test failed before the guard and passes now.
• Five focused Firestore helper assertions initially failed for missing-vs-null, cross-type ranges, structural equality, and nested normalization; all pass after the semantic alignment.
• The first emulator launch failed inside Firebase CLI because the root path-to-regexp override supplied an Express-incompatible API; removing that override made the real emulator contract pass.
• The first package dry run included the emulator spec in the publish archive; the Firestore build now excludes it and the corrected dry run contains runtime artifacts only.

Intentional breaking refinements

• Import defineTypeOrmRepository from @concepta/rockets-repository-typeorm, not @concepta/rockets or its removed /typeorm subpath.
• Pass synchronous Firebase options directly to defineFirebaseAuth(...); forRootAsync remains nested.
• Public packages require Node.js 20 or newer.
• Recovery passcode validation is now POST /recovery/passcode with { passcode }, replacing the GET route that exposed the passcode in the URL.
• Local auth CQRS messages and ports now take the canonical app context explicitly; the duplicate createRepositoryContext / RepositoryContextInterface surface is removed.
• Placeholder Swagger generator bins and unsupported controller-extra contracts are removed.
• Built-in auth contributes its complete composition and defaults the separate Rockets global guard off because the upstream JWT guard already owns that responsibility.

No package version bump is included; versioning remains an independent review decision.

Verification

• corepack yarn install --immutable
• corepack yarn release:check
  • 60 public package artifact targets verified and dry-run packed
  • 69 unit files / 602 tests passed
  • 32 package E2E files / 164 tests passed
  • Firestore emulator: 1 file / 3 tests passed
  • sample-server: 8 files / 194 tests passed
  • sample-server-auth: 2 files / 40 tests passed
  • sample-code-review API: 8 tests passed / 1 external integration skipped
• Corrected Firestore package dry run verified the emulator spec is absent from the publish archive.
• GitHub Actions: Node 20 / Java 21 release-check passed, and the Node 22 build/coverage job passed with the native .mts loader assertion.

This remains one broad PR because composition, auth, repository semantics, packaging, examples, and docs are coupled parts of the same 1.0 contract and are now guarded together.