feat(api): foundation canon JCS — Pino+CLS+RFC9457+health+ping (Frente A)

Estabelece a fundação operacional de apps/api conforme STACK.md v2.2 e
CODING-RULES.md v2.0, substituindo o hello-world scaffolded.

- tracing.ts primeiro import (PGD-OBS-001) — stub OTel ativável por env
- EnvSchema Zod 4 com fail-fast (superRefine guarda prod) + EnvModule global
- nestjs-pino com redact LGPD (*.cpf|*.cardNumber|*.password|auth|cookie)
- main.ts hardenizado: helmet, CORS por env, compression, versionamento URI
  /api/v1, graceful shutdown
- ProblemDetailsFilter global (RFC 9457 application/problem+json), Zod -> 422
- Health endpoints /api/v1/health/{live,ready} com memory.checkHeap(350MB)
  (ready skeleton documenta K=3 LRU pool conforme PGD-OBS-003)
- WorkspaceModule via ClsModule.forRootAsync — requestId+workspaceId no CLS,
  idGenerator alinhado com pino-http para mesmo UUID em header e body
- GET /api/v1/ping retornando workspaceId+requestId (alvo de smoke test e
  futuro healthcheck do docker compose)
- ZodValidationPipe (nestjs-zod) como APP_PIPE global
- tsconfig.app.json target ES2023 (alinhado ao base)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/api/src/app/workspace/workspace.module.ts

@@ -0,0 +1,48 @@
+import { Module } from '@nestjs/common';
+import { ClsModule } from 'nestjs-cls';
+import { ConfigModule, ConfigService } from '@nestjs/config';
+import { randomUUID } from 'node:crypto';
+import type { Request, Response } from 'express';
+import type { WorkspaceClsStore } from './workspace.types';
+import type { Env } from '../config/env.schema';
+
+// CLS popula contexto por request. Hoje: requestId + DEFAULT_WORKSPACE_ID do env.
+// Amanhã: workspaceId vem do JWT (PGD-AUTHZ-002); `prisma` é resolvido pelo
+// WorkspacePrismaPool e injetado via cls.set('prisma', ...) aqui mesmo.
+
+@Module({
+  imports: [
+    ClsModule.forRootAsync({
+      global: true,
+      imports: [ConfigModule],
+      inject: [ConfigService],
+      useFactory: (config: ConfigService<Env, true>) => ({
+        middleware: {
+          mount: true,
+          generateId: true,
+          idGenerator: (req: Request) => {
+            // Prioridade: req.id (pino-http já gerou/leu header) > header bruto > novo UUID.
+            const fromPino = (req as Request & { id?: unknown }).id;
+            if (typeof fromPino === 'string' && fromPino.length > 0) return fromPino;
+            const headerVal = req.headers['x-request-id'];
+            return typeof headerVal === 'string' && headerVal.length > 0
+              ? headerVal
+              : randomUUID();
+          },
+          setup: (cls, req: Request, res: Response) => {
+            const store = cls as unknown as {
+              set: <K extends keyof WorkspaceClsStore>(key: K, value: WorkspaceClsStore[K]) => void;
+              getId: () => string;
+            };
+            const requestId = store.getId();
+            res.setHeader('x-request-id', requestId);
+            store.set('requestId', requestId);
+            store.set('workspaceId', config.get('DEFAULT_WORKSPACE_ID', { infer: true }));
+          },
+        },
+      }),
+    }),
+  ],
+  exports: [ClsModule],
+})
+export class WorkspaceModule {}