Fase 1a: microservicio tcef-notifications (workers FCM v1 + email)

Sustituye el envío de push por la API legacy de GCM (muerta desde jun-2024) y
saca el envío del observer de Meteor a una cola BullMQ controlada.

- poller: consume 'notifications' pendientes (campos correctos; el cron viejo
  tenía un typo nofitied/emailNofitied que nunca casaba)
- fcm-worker: firebase-admin (FCM HTTP v1), payload compatible con la app
  Flutter (FLUTTER_NOTIFICATION_CLICK, collapseKey=_id, data); purga tokens
  muertos sin reintentar
- email-worker: nodemailer + plantillas new-fire portadas verbatim
- idempotencia persistente: notification_sends, indice unico (notificationId,
  channel) -> sobrevive reinicios y replays
- salvaguardas anti-spam: modos dry-run/shadow/canary/full, exclusion mutua por
  canal (OWNED_CHANNELS + notifDisabledChannels en Meteor), kill switch,
  limites por usuario/dia y circuit breaker por batch
- docs/legacy-behavior.md (caracterizacion) + docs/rollout.md
- 47 tests (vitest + mongodb-memory-server), typecheck y build OK
- deploy: systemd + pm2 (Node 22 standalone)

Falta el service account de Firebase para envio real de push (pedir al usuario).

test/config.test.ts

@@ -0,0 +1,32 @@
+import { describe, expect, it } from 'vitest';
+import { loadConfig } from '../src/config.js';
+
+const base = { MONGO_URL: 'mongodb://localhost/fuegos', CONFIG_FILE: '/nonexistent.json' };
+
+describe('loadConfig', () => {
+  it('defaults to the safest mode (dry-run) with no channels owned', () => {
+    const cfg = loadConfig({ ...base } as NodeJS.ProcessEnv);
+    expect(cfg.mode).toBe('dry-run');
+    expect(cfg.ownedChannels).toEqual([]);
+    expect(cfg.killSwitch).toBe(false);
+  });
+
+  it('requires MONGO_URL', () => {
+    expect(() => loadConfig({ CONFIG_FILE: '/nonexistent.json' } as NodeJS.ProcessEnv)).toThrow(/MONGO_URL/);
+  });
+
+  it('rejects an invalid mode', () => {
+    expect(() => loadConfig({ ...base, MODE: 'nuke' } as NodeJS.ProcessEnv)).toThrow(/Invalid MODE/);
+  });
+
+  it('parses OWNED_CHANNELS and rejects unknown channels', () => {
+    expect(loadConfig({ ...base, OWNED_CHANNELS: 'fcm,email' } as NodeJS.ProcessEnv).ownedChannels).toEqual(['fcm', 'email']);
+    expect(() => loadConfig({ ...base, OWNED_CHANNELS: 'fcm,telegram' } as NodeJS.ProcessEnv)).toThrow(/Invalid channel/);
+  });
+
+  it('parses KILL_SWITCH and canary lists', () => {
+    const cfg = loadConfig({ ...base, KILL_SWITCH: '1', CANARY_USER_IDS: 'a, b ,c', MODE: 'canary' } as NodeJS.ProcessEnv);
+    expect(cfg.killSwitch).toBe(true);
+    expect(cfg.canary.userIds).toEqual(['a', 'b', 'c']);
+  });
+});