feat(api): add fleet snapshots and durable event stream

apps/api/src/control-plane.test.ts

@@ -23,6 +23,63 @@ class Store implements SecretStore {
   }
 }
 describe('buildControlPlaneApp', () => {
+  it('registers the durable event route fail-closed when no authentication dependency is supplied', async () => {
+    const db = new Database(':memory:');
+    db.pragma('foreign_keys=ON');
+    migrateDatabase(db);
+    dbs.push(db);
+    const app = buildControlPlaneApp({
+      db,
+      store: new Store(),
+      upstream: {
+        get: async () => ({ status: 200, headers: {}, body: '' }),
+        request: async () => ({ status: 200, headers: {}, body: '' }),
+        postNetworkRegisterAuto: async () => ({ status: 200 }),
+      },
+    });
+
+    const response = await app.inject({ method: 'GET', url: '/api/v1/events' });
+
+    expect(response.statusCode).toBe(401);
+    expect(response.headers['content-type']).toContain('application/problem+json');
+    expect(response.json()).toMatchObject({ status: 401, code: 'UNAUTHORIZED' });
+    await app.close();
+  });
+
+  it('passes an explicit event-stream authenticator to durable cursor replay', async () => {
+    const db = new Database(':memory:');
+    db.pragma('foreign_keys=ON');
+    migrateDatabase(db);
+    dbs.push(db);
+    const app = buildControlPlaneApp({
+      db,
+      store: new Store(),
+      upstream: {
+        get: async () => ({ status: 200, headers: {}, body: '' }),
+        request: async () => ({ status: 200, headers: {}, body: '' }),
+        postNetworkRegisterAuto: async () => ({ status: 200 }),
+      },
+      authenticateEventStream: (request) => request.headers.authorization === 'Bearer allowed',
+    });
+
+    const response = await app.inject({
+      method: 'GET',
+      url: '/api/v1/events',
+      headers: {
+        authorization: 'Bearer allowed',
+        'last-event-id': 'unknown-cursor',
+      },
+    });
+
+    expect(response.statusCode).toBe(409);
+    expect(response.headers['content-type']).toContain('application/problem+json');
+    expect(response.json()).toMatchObject({
+      status: 409,
+      code: 'EVENT_POSITION_UNAVAILABLE',
+    });
+    await app.close();
+  });
+
   it('assembles instance CRUD, connection checks, login and logout without listening or reading external config', async () => {
     const db = new Database(':memory:');
     db.pragma('foreign_keys=ON');