feat(git-sync): vendor IO engine (pull/push/git/settings) with GitSyncClient seam (Phase A.3)

Vendor the IO engine from docmost-sync into packages/git-sync/src/engine:
- git.ts (VaultGit, execFile shell-out — verbatim)
- pull.ts (readExisting, computePullActions, applyPullActions)
- push.ts (classifyRenameMoves, computePushActions, applyPushActions, runPush)
- settings.ts adapted (pure parseSettings + Settings type; no process.env binding
  — the server builds Settings from EnvironmentService later), config-errors.ts.
CLI main()/import.meta entrypoints dropped (server drives in-process).

Client seam: new engine/client.types.ts defines GitSyncClient; pull.ts/push.ts
now use Pick<GitSyncClient, ...> instead of the non-vendored DocmostClient. Engine
logic byte-identical except a zod4-compat fix in config-errors (zod4 dropped the
issue.received==='undefined' signal; match /received undefined/ on the message).

Ported the engine unit tests (compute/apply pull+push actions, classify-rename-
moves, run-push, settings, config-errors) incl. real-git temp-repo tests: 431
pass / 3 expected-fail (was 314/3). REST/CLI-coupled upstream tests skipped
(noted). CJS build clean. No apps/server wiring yet (next step).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

packages/git-sync/build/engine/settings.js

@@ -0,0 +1,55 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.envSchema = void 0;
+exports.parseSettings = parseSettings;
+/**
+ * Engine settings (plan §2.1 / §7.2 — ADAPTED for vendoring).
+ *
+ * Upstream this module also loaded `.env` (`dotenv`) and bound `parseSettings`
+ * to `process.env` via a `loadSettings()` entry point. In gitmost the engine is
+ * driven IN-PROCESS by the NestJS server, which builds the `Settings` object
+ * from `EnvironmentService` (plan §7.2) — so the engine must NOT reach into
+ * `process.env` here. We therefore vendor ONLY:
+ *   - the `Settings` type the engine consumes, and
+ *   - `parseSettings(env)` as a PURE function (validate a raw env object -> typed
+ *     `Settings`), kept for unit tests and for the server to reuse if it wants
+ *     to validate an env-shaped object.
+ * The `loadSettings()` / `loadDotenv()` side-effecting entry point is dropped.
+ */
+const zod_1 = require("zod");
+// Schema keyed by the real ENV variable names so validation errors name the
+// exact variable. Credentials and the address of our OWN Docmost instance have
+// NO default — a missing value must fail at startup, never silently fall back.
+exports.envSchema = zod_1.z.object({
+    // Docmost connection — address of our own instance, no default.
+    DOCMOST_API_URL: zod_1.z.string().url(),
+    // Credentials for /auth/login — no default, never hardcoded.
+    DOCMOST_EMAIL: zod_1.z.string().min(1),
+    DOCMOST_PASSWORD: zod_1.z.string().min(1),
+    // Which Docmost space to mirror.
+    DOCMOST_SPACE_ID: zod_1.z.string().min(1),
+    // Local git vault (state store) — kept under data/ so the volume persists it.
+    VAULT_PATH: zod_1.z.string().min(1).default('data/vault'),
+    // Optional git remote the vault pushes to. Empty string is treated as unset.
+    GIT_REMOTE: zod_1.z.preprocess((v) => (v === '' ? undefined : v), zod_1.z.string().min(1).optional()),
+    // Non-secret tunables — sensible defaults are fine.
+    POLL_INTERVAL_MS: zod_1.z.coerce.number().int().positive().default(15000),
+    DEBOUNCE_MS: zod_1.z.coerce.number().int().positive().default(2000),
+    LOG_LEVEL: zod_1.z.enum(['debug', 'info', 'warn', 'error']).default('info'),
+});
+// Pure: validate a raw environment object and map it to a typed Settings.
+// Throws ZodError on bad config. No side effects — safe to import in tests.
+function parseSettings(env) {
+    const e = exports.envSchema.parse(env);
+    return {
+        docmostApiUrl: e.DOCMOST_API_URL,
+        docmostEmail: e.DOCMOST_EMAIL,
+        docmostPassword: e.DOCMOST_PASSWORD,
+        docmostSpaceId: e.DOCMOST_SPACE_ID,
+        vaultPath: e.VAULT_PATH,
+        gitRemote: e.GIT_REMOTE,
+        pollIntervalMs: e.POLL_INTERVAL_MS,
+        debounceMs: e.DEBOUNCE_MS,
+        logLevel: e.LOG_LEVEL,
+    };
+}