feat(us3): implement the todos-api operational contract

[EstebanGZam]

What changes

Implements the todos-api operational contract for full-platform User Story 3:

• unauthenticated startup, readiness, and liveness probes plus Prometheus metrics;
• end-to-end X-Request-Id correlation, including the Redis audit event;
• default-off, non-secret runtime configuration;
• bounded, best-effort Redis audit publication with an error listener and circuit breaker;
• a non-root distroless runtime that contains every module loaded by server.js;
• a patched, digest-pinned runtime base without HIGH or CRITICAL findings.

Why

Redis carries the audit log, not todo state. Previously an unhandled Redis error event could terminate the Node process, and a publish that never settled could couple request behavior to a logging dependency. Health endpoints mounted behind JWT would also answer 401 and cause Kubernetes to restart a healthy process.

Runtime verification found one additional packaging defect: server.js required ./operational, but the final image did not copy operational.js, so the container could not start. The added packaging contract captures that failure before the Dockerfile correction.

The previous runtime digest also contained CVE-2026-14456 in libssl3t64. The current pinned distroless digest contains the patched package; no vulnerability suppression was added.

Tasks

• microservice-app-gitops/specs/009-full-platform-rollout T075
• microservice-app-gitops/specs/009-full-platform-rollout T080
• The task register is updated in this pull request — the authoritative register is owned by another repository, so the paired update is microservice-app-gitops#85.
• Every task ticked in the paired register update was verified by locating its named artifact.

How it is verified

• Commit 590b2e8 introduced the operational contract tests red before commit 87fd274 implemented them.
• Commit 515fbda introduced the runtime packaging test red with: server.js requires ./operational, but the runtime image does not copy operational.js. Commit 48627b2 made that test pass by packaging the module.
• npm test: 17 tests passed, including the real Redis Testcontainers integration; 0 failed.
• npm audit --omit=dev --audit-level=high: found 0 vulnerabilities.
• npx --yes @stoplight/spectral-cli@6 lint contracts/openapi.yaml contracts/asyncapi.yaml --ruleset .spectral.yaml: no errors.
• docker build --no-cache --progress=plain -t microtodosuite/todos-api-us3:local .: succeeded and copied operational.js into the final stage.
• Runtime smoke test: all three health endpoints returned 200, the image ran as 65532:65532, and X-Request-Id: smoke-correlation-id was echoed unchanged.
• Trivy v0.72.0 against the exact rebuilt image, with the CI policy --severity HIGH,CRITICAL --ignore-unfixed --exit-code 1: Debian findings 0, Node package findings 0, exit 0.
• Mutation checks previously exercised the independent failure paths: removing the Redis error listener, restoring direct publish, or mounting probes after JWT each made its corresponding test fail.

Risk and rollback

The additive audit correlationId field and Redis failure handling are the main behavior changes. A bad timeout or breaker threshold could reduce audit delivery during an outage, but cannot fail the todo request. Roll back by reverting the implementation commits; revert the digest commit separately if the upstream image causes a runtime regression.

What this PR does not do

It does not deploy the service, change a GitOps overlay, activate a full-profile environment, suppress a vulnerability, or create an approval/acceptance artifact. Deployment remains owned by microservice-app-gitops and ArgoCD.