test(broker): coverage for hardening modules — caps, limits, metrics, health, logs

Adds 23 tests across 4 files, taking total broker coverage from
21 → 44 passing in ~2.5s.

Unit tests (no I/O):
- tests/rate-limit.test.ts (6): TokenBucket capacity, refill rate,
  no-overflow cap, independent buckets per key, sweep GC.
- tests/metrics.test.ts (5): all 10 series present in /metrics,
  counter increment semantics, labelled series produce distinct lines,
  gauge set overwrites, Prometheus format well-formed.
- tests/logging.test.ts (5): JSON per line, required fields (ts, level,
  component, msg), context merging, level preservation, no plain-text
  escape hatches.

Integration tests (spawn real broker subprocesses on random ports):
- tests/integration/health.test.ts (7):
  * GET /health 200 + {status, db, version, gitSha, uptime} (healthy DB)
  * GET /health 503 + {status:degraded, db:down} (unreachable DB)
  * GET /metrics 200 text/plain with all expected series
  * GET /nope → 404
  * POST /hook/set-status oversized body → 413
  * POST /hook/set-status 6th req/min → 429
  * Rate limit isolation by (pid, cwd) key

Integration tests use node:child_process (vitest runs under Node, not
Bun — Bun.spawn isn't available). Each suite spawns its own broker
subprocess with a random port + tailored env vars.

Not yet covered (flagged for follow-up):
- WebSocket connection caps (needs seeded mesh + WS client setup)
- WebSocket message-size rejection (ws.maxPayload behavior)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

apps/broker/tests/logging.test.ts

@@ -0,0 +1,71 @@
+/**
+ * Structured logger output format tests.
+ *
+ * Intercepts stderr and asserts: one JSON object per line, required
+ * fields present, merged context preserved, no plain text leaks.
+ */
+
+import { afterEach, beforeEach, describe, expect, test, vi } from "vitest";
+import { log } from "../src/logger";
+
+let captured: string[] = [];
+let originalError: typeof console.error;
+
+beforeEach(() => {
+  captured = [];
+  originalError = console.error;
+  console.error = vi.fn((msg: unknown) => {
+    captured.push(String(msg));
+  });
+});
+
+afterEach(() => {
+  console.error = originalError;
+});
+
+describe("structured logger", () => {
+  test("emits one JSON object per log call", () => {
+    log.info("test msg");
+    expect(captured).toHaveLength(1);
+    expect(() => JSON.parse(captured[0]!)).not.toThrow();
+  });
+
+  test("required fields: ts, level, component, msg", () => {
+    log.info("hello");
+    const entry = JSON.parse(captured[0]!) as Record<string, unknown>;
+    expect(entry.ts).toBeTruthy();
+    expect(entry.level).toBe("info");
+    expect(entry.component).toBe("broker");
+    expect(entry.msg).toBe("hello");
+    // ts should be valid ISO 8601
+    expect(() => new Date(entry.ts as string)).not.toThrow();
+  });
+
+  test("context object is merged into the entry", () => {
+    log.warn("capacity", { mesh_id: "m1", existing: 100, cap: 100 });
+    const entry = JSON.parse(captured[0]!) as Record<string, unknown>;
+    expect(entry.level).toBe("warn");
+    expect(entry.mesh_id).toBe("m1");
+    expect(entry.existing).toBe(100);
+    expect(entry.cap).toBe(100);
+  });
+
+  test("all four levels preserved on their respective emits", () => {
+    log.debug("d");
+    log.info("i");
+    log.warn("w");
+    log.error("e");
+    const levels = captured.map((s) => JSON.parse(s).level);
+    expect(levels).toEqual(["debug", "info", "warn", "error"]);
+  });
+
+  test("no plain-text escape hatches — output is always JSON", () => {
+    log.info("line 1");
+    log.error("line 2", { code: "X" });
+    log.debug("line 3");
+    for (const line of captured) {
+      expect(line.trim()).toMatch(/^\{.*\}$/);
+      expect(() => JSON.parse(line)).not.toThrow();
+    }
+  });
+});