Adopt Cleverbrush Framework v5.0.0

[andrewzolotukhin]

Original request

Adopt Cleverbrush Framework libraries v5.0.0, review the changes through Context7, and implement the agreed adoption plan using pr-workflow. The selected scope upgrades existing integrations rather than adding new Framework capabilities.

What changed

• Pin all 17 directly used Framework packages across six workspaces to exact 5.0.0, including orm-cli.
• Regenerate and deduplicate the lockfile: all 19 installed Framework packages resolve to 5.0.0, with one root schema installation. Preserve unrelated transitive package versions.
• Align root/API Node type declarations to 24.19.2, the Telegram bot build target to node24, and its direct OpenTelemetry instrumentation hook to 0.222.0.
• Run the API production typecheck with --checkers 1 and set a build-only GOMEMLIMIT=1536MiB for the native TypeScript compiler in the API Docker builder. The first preview deployment exhausted its 4 GB host and the kernel killed tsc; the application runtime is unaffected.
• Update the Framework reference with the stable release, actual changes from the adopted October 4 beta, and unchanged scheduler storage compatibility.

Reasoning

Latest main already uses the v5-era APIs: immutable and compiled reads, synchronous mapping, durable jobs, typed uploads, schema forms, Node 24 and scoped transaction replay. This PR preserves those integrations and application contracts while replacing prerelease dependencies with the stable coordinated release.

The release-tag comparison identifies fixes for default-only database migrations, middleware-rejected WebSocket subscriptions, zero subscription-history limits and shared HashObject behavior. Scheduler storage schemas/migrations are unchanged; no database migration or job-definition version change is introduced.

TypeScript 7 normally starts four checker workers. Limiting the production API build to one checker reduces peak memory without excluding source files or tests; the ordinary CI typecheck remains unchanged. This addresses the preview host kernel killing tsc at approximately 2.8 GB resident memory on a 4 GB host.

Existing feature-owned tests cover the behavior being retained. There is no new business logic requiring a separate release-specific test suite. npm deduplication required overriding the repository's existing Next.js preview/Keystatic peer mismatch; the final lockfile passes ordinary npm ci without force or legacy peer flags.

Blog post

Skipped: this is dependency/runtime maintenance with no new public feature or UI behavior.

Screenshots / preview evidence

Preview: https://xpenser-pr-103.cleverbrush.com

Dependency pins introduce no visual change, so before/after screenshots are not applicable. The Playwright report artifact includes existing transaction-list screenshot evidence. In the deployed API image, all 19 Framework packages (including workspace-local schema-json/server-openapi) resolve to 5.0.0.

Manual Playwright QA passed login, required-category validation with values preserved, correction and transaction creation, reopening with the original note, editing 12.34 to 23.45, persistence after reload, and deletion. No browser errors were observed; specifically named manual test transactions were verified absent after cleanup.

Validation

• Passed ordinary clean install: npm ci --no-audit --no-fund.
• Passed npm run lint and npm run typecheck.
• Passed complete unit suite: npm test -- --maxWorkers=2 — 125 files / 1,961 tests.
• Passed npm run build across all seven workspaces, including API, web and Telegram bot production builds.
• Passed npm run test:queries:integration against isolated PostgreSQL: 7 files / 61 tests in UTC, and again with TZ=America/Los_Angeles. Includes transaction replay, permissions, typed reads, migrations and durable-job recovery.
• Passed local API, web and Telegram bot Docker image builds. API/bot runtime imports resolve stable Framework packages and instrumentation hooks; the web runtime responds HTTP 200.
• Passed final API production build with one checker and GOMEMLIMIT=1536MiB, plus the existing preview configuration suite (8 tests).
• Passed complete API typecheck in a read-only Node 24 container capped at 2 GB RAM / two CPUs: 1,004 files, 1,139,173 KB reported memory and 9.505 seconds.
• Exact deployed commit e24ed98: Lint and test passed, Deploy PR environment passed, and Playwright e2e passed — all 40 browser tests, including transaction retry/replay, lists, forms, uploads, durable scans, budgets, auth and OpenAPI.
• Preview API, web and PostgreSQL are running; API/PostgreSQL are healthy and preview returns HTTP 200. Initial deployment attempts hit kernel OOM with four native TypeScript checkers; the final single-checker build deployed successfully after the stale compiler was killed and the host recovered.
• Manual preview QA: passed the transaction lifecycle and validation recovery described above.
• SigNoz, scoped to xpenser-api-pr-103 and xpenser-web-pr-103 during manual QA: 4,750 API spans and 517 web spans present; zero error spans; zero warning/error/fatal logs using severity_number >= 13; request logs correlate with the same trace ID and parent span IDs. API http.server.request.duration.count records 28 requests in that window.
• Telemetry limitations: SigNoz histogram-percentile queries returned backend HTTP 500, so latency-percentile validation is skipped. The existing web setup exports Next.js traces without HTTP metric instrumentation; a separate web HTTP metric check is not applicable. The Telegram bot is not started in PR environments; its local unit, production-build and runtime-import checks passed.
• PR-ready notification: sent successfully via the configured notifier (HTTP 200) after required checks, preview QA and telemetry verification/explicit metric limitation.

Checklist

• Change is focused and reference documentation is current.
• No credentials, local environment files or generated build output are committed.
• Public contracts, endpoint metadata and handlers retain existing behavior.
• Existing feature-owned unit and PostgreSQL coverage passes.
• Required GitHub checks, preview QA and telemetry verification are complete, with the metric limitation recorded.