fix(release): Enforce quality gates and organize Rust modules

[yuanzui-cf]

Summary

Release publication previously ran independently of quality checks, Console checks did not enforce TypeScript types, and embedded assets could remain stale across builds. This change makes publication depend on the reusable Quality workflow for the same commit and completes the corresponding validation paths.

• Run PR quality checks, MSRV verification, dependency audits, service regressions and Node delivery smoke without building distributable images. Avoid duplicate Quality runs on ordinary branch pushes. Release builds and checks the Debian, Slim and Alpine images after validation, then publishes with the same Bake inputs and cache.
• Enable strict Console type checking and repair concrete component, API and fixture mismatches.
• Set the workspace MSRV to Rust 1.88 based on cargo-msrv measurements, with Linux and macOS verification against the committed lockfile.
• Track Console output changes, isolate generated embedded assets by build profile and add a production just release entrypoint with incremental asset regressions.
• Run the complete PostgreSQL/Redis suite against disposable CI services. Explicitly ignore service-dependent tests in ordinary runs and fail when the service suite is selected without configuration. Scope authentication enum assertions to their fixture schema.
• Distinguish stable release aliases from exact prerelease tags and explicitly mark GitHub prereleases. Update rustls to 0.23.45 and rustls-webpki to 0.103.15 to resolve RUSTSEC-2026-0285 found by the quality gate.
• Split Node serving, storage adapters/write coordination and migration regressions into focused modules. Preserve public entrypoints, authorization boundaries and test inventories while improving Rust SQL, JSON, imports and declaration formatting.

Validation

• just quality: passed, including 702 Rust fast tests, 239 Console tests, formatting, lint/type checks, builds, embedded asset regressions and release metadata tests.

• vp exec tsc --noEmit: passed. Temporary incompatible assignments confirmed that both TypeScript checkers reject type errors; the probes were removed.

• cargo msrv find: established Rust 1.88; final just msrv passed after the Rust changes and dependency update.

• just release: passed. Both binaries report version 0.1.0; the Control API binary contains the current Console HTML and all 121 JavaScript assets.

• actionlint, cargo audit and vp pm audit: passed. Docker Bake dry runs confirm that verification and publication use identical targets, tags and build inputs. Temporary shell checks cover multi-tag selection, all six binary checks, early failure and empty-tag rejection.

• Earlier packaging validation: Quality run 34957058990 passed all six jobs for commit 0d478fd2ceb2b1e14c514dc158c35610b4640436: Quality, Linux/macOS MSRV, 31 Control API service regressions plus three Redis cache regressions, Node delivery smoke, and Debian/Slim/Alpine image builds with packaged binary checks. Image verification now runs in Release; PR Quality has five jobs.

• Final PR Quality run 34969634955 passed all five jobs for commit 1414ca0f37fc470cb0349e65df58fa0659bbf92f: Quality, Node delivery smoke, Linux/macOS MSRV, and PostgreSQL/Redis regressions. The run was triggered only by pull_request and contains no distributable-image build job.

Tracking

Parent tracking issue: #219. Milestone: 0.1.0.

Closes #220
Closes #221
Closes #222
Closes #223
Closes #224
Closes #225
Closes #226
Closes #227
Closes #228

Known Limitations

• Console architecture and duplicate Toast/Alert cleanup are deferred. Existing advisory frontend lint warnings and six allowed dependency-audit warnings remain visible.
• The Chromium screenshot test and standalone Docker socket regression were not executed. The separate Node delivery smoke passed in CI.
• Publication policy was validated without creating a release tag or publishing artifacts.