test(broker): coverage for hardening modules — caps, limits, metrics, health, logs

Adds 23 tests across 4 files, taking total broker coverage from
21 → 44 passing in ~2.5s.

Unit tests (no I/O):
- tests/rate-limit.test.ts (6): TokenBucket capacity, refill rate,
  no-overflow cap, independent buckets per key, sweep GC.
- tests/metrics.test.ts (5): all 10 series present in /metrics,
  counter increment semantics, labelled series produce distinct lines,
  gauge set overwrites, Prometheus format well-formed.
- tests/logging.test.ts (5): JSON per line, required fields (ts, level,
  component, msg), context merging, level preservation, no plain-text
  escape hatches.

Integration tests (spawn real broker subprocesses on random ports):
- tests/integration/health.test.ts (7):
  * GET /health 200 + {status, db, version, gitSha, uptime} (healthy DB)
  * GET /health 503 + {status:degraded, db:down} (unreachable DB)
  * GET /metrics 200 text/plain with all expected series
  * GET /nope → 404
  * POST /hook/set-status oversized body → 413
  * POST /hook/set-status 6th req/min → 429
  * Rate limit isolation by (pid, cwd) key

Integration tests use node:child_process (vitest runs under Node, not
Bun — Bun.spawn isn't available). Each suite spawns its own broker
subprocess with a random port + tailored env vars.

Not yet covered (flagged for follow-up):
- WebSocket connection caps (needs seeded mesh + WS client setup)
- WebSocket message-size rejection (ws.maxPayload behavior)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

apps/broker/tests/rate-limit.test.ts

@@ -0,0 +1,76 @@
+/**
+ * TokenBucket tests — pure unit tests, no I/O.
+ *
+ * Verifies the rate limiter applied to POST /hook/set-status.
+ * Uses injected `now` timestamps to avoid sleeps.
+ */
+
+import { describe, expect, test } from "vitest";
+import { TokenBucket } from "../src/rate-limit";
+
+describe("TokenBucket", () => {
+  test("allows up to `capacity` requests in a burst", () => {
+    const b = new TokenBucket(5, 60); // 5 capacity, 60/min refill
+    const t0 = 1_000_000;
+    for (let i = 0; i < 5; i++) {
+      expect(b.take("key", t0)).toBe(true);
+    }
+    expect(b.take("key", t0)).toBe(false);
+  });
+
+  test("30/min means 31st in first minute is rejected", () => {
+    const b = new TokenBucket(30, 30);
+    const t0 = 1_000_000;
+    // Burst: drain the bucket at t0.
+    for (let i = 0; i < 30; i++) expect(b.take("p:cwd", t0)).toBe(true);
+    expect(b.take("p:cwd", t0)).toBe(false);
+  });
+
+  test("refills over time", () => {
+    const b = new TokenBucket(5, 60); // refill rate = 60/min = 1/sec
+    const t0 = 1_000_000;
+    // Drain
+    for (let i = 0; i < 5; i++) b.take("k", t0);
+    expect(b.take("k", t0)).toBe(false);
+    // +1 second = +1 token
+    expect(b.take("k", t0 + 1000)).toBe(true);
+    expect(b.take("k", t0 + 1000)).toBe(false);
+    // +2 more seconds = +2 tokens
+    expect(b.take("k", t0 + 3000)).toBe(true);
+    expect(b.take("k", t0 + 3000)).toBe(true);
+  });
+
+  test("does not refill beyond capacity", () => {
+    const b = new TokenBucket(5, 60);
+    const t0 = 1_000_000;
+    b.take("k", t0); // 4 remaining
+    // Jump forward way past full refill
+    const far = t0 + 60 * 60 * 1000; // +1 hour
+    // Should allow only `capacity` consecutive takes, not more
+    for (let i = 0; i < 5; i++) expect(b.take("k", far)).toBe(true);
+    expect(b.take("k", far)).toBe(false);
+  });
+
+  test("different keys have independent buckets", () => {
+    const b = new TokenBucket(2, 60);
+    const t0 = 1_000_000;
+    expect(b.take("a", t0)).toBe(true);
+    expect(b.take("a", t0)).toBe(true);
+    expect(b.take("a", t0)).toBe(false);
+    // "b" is fresh.
+    expect(b.take("b", t0)).toBe(true);
+    expect(b.take("b", t0)).toBe(true);
+    expect(b.take("b", t0)).toBe(false);
+  });
+
+  test("sweep removes buckets older than threshold", () => {
+    const b = new TokenBucket(5, 60);
+    const t0 = 1_000_000;
+    b.take("stale", t0);
+    b.take("fresh", t0 + 100_000);
+    expect(b.size).toBe(2);
+    // Sweep anything untouched for >60s, as of t0 + 90s.
+    b.sweep(60_000, t0 + 90_000);
+    expect(b.size).toBe(1);
+  });
+});