Fase 1a: microservicio tcef-notifications (workers FCM v1 + email)

Sustituye el envío de push por la API legacy de GCM (muerta desde jun-2024) y
saca el envío del observer de Meteor a una cola BullMQ controlada.

- poller: consume 'notifications' pendientes (campos correctos; el cron viejo
  tenía un typo nofitied/emailNofitied que nunca casaba)
- fcm-worker: firebase-admin (FCM HTTP v1), payload compatible con la app
  Flutter (FLUTTER_NOTIFICATION_CLICK, collapseKey=_id, data); purga tokens
  muertos sin reintentar
- email-worker: nodemailer + plantillas new-fire portadas verbatim
- idempotencia persistente: notification_sends, indice unico (notificationId,
  channel) -> sobrevive reinicios y replays
- salvaguardas anti-spam: modos dry-run/shadow/canary/full, exclusion mutua por
  canal (OWNED_CHANNELS + notifDisabledChannels en Meteor), kill switch,
  limites por usuario/dia y circuit breaker por batch
- docs/legacy-behavior.md (caracterizacion) + docs/rollout.md
- 47 tests (vitest + mongodb-memory-server), typecheck y build OK
- deploy: systemd + pm2 (Node 22 standalone)

Falta el service account de Firebase para envio real de push (pedir al usuario).

test/helpers.ts

@@ -0,0 +1,89 @@
+import { MongoMemoryServer } from 'mongodb-memory-server';
+import { pino } from 'pino';
+import { ObjectId } from 'mongodb';
+import { connect, ensureIndexes, type Repos } from '../src/db.js';
+import type { Config } from '../src/config.js';
+import type { FcmClient, FcmSendResult } from '../src/fcm.js';
+import type { Mailer } from '../src/mailer.js';
+import type { EmailContent, PushPayload } from '../src/messages.js';
+import type { NotificationDoc, UserDoc } from '../src/types.js';
+
+export const silentLog = pino({ level: 'silent' });
+
+export async function startMongo(): Promise<{ server: MongoMemoryServer; repos: Repos; cfg: Config }> {
+  const server = await MongoMemoryServer.create();
+  const cfg = testCfg({ mongoUrl: server.getUri(), dbName: 'fuegos' });
+  const repos = await connect(cfg);
+  await ensureIndexes(repos);
+  return { server, repos, cfg };
+}
+
+export function testCfg(over: Partial<Config> = {}): Config {
+  return {
+    mode: 'full',
+    killSwitch: false,
+    ownedChannels: ['fcm', 'email'],
+    mongoUrl: 'mongodb://x',
+    dbName: 'fuegos',
+    redis: { host: 'x', port: 6379, db: 0 },
+    poll: { intervalMs: 1000, batchSize: 500 },
+    limits: { perUserPerDay: 20, maxPerBatch: 2000 },
+    canary: { userIds: [], subsIds: [] },
+    retries: { attempts: 3, backoffMs: 100 },
+    fcm: {},
+    email: { from: 'test <t@x>' },
+    rootUrl: 'https://fuegos.comunes.org/',
+    gmaps: {},
+    logLevel: 'silent',
+    serviceName: 'tcef-notifications',
+    ...over,
+  };
+}
+
+export function aNotif(over: Partial<NotificationDoc> = {}): NotificationDoc {
+  return {
+    _id: new ObjectId(),
+    userId: 'u1',
+    subsId: new ObjectId(),
+    content: '🔥 Fuego cerca:',
+    geo: { type: 'Point', coordinates: [-8.5, 42.3] },
+    type: 'mobile',
+    when: new Date('2026-07-12T18:30:00Z'),
+    sealed: 'fire-1',
+    ...over,
+  };
+}
+
+export function aUser(over: Partial<UserDoc> = {}): UserDoc {
+  return {
+    _id: 'u1',
+    lang: 'es',
+    fireBaseToken: 'tok-abc',
+    profile: { name: { first: 'Ana' } },
+    emails: [{ address: 'ana@example.com', verified: true }],
+    ...over,
+  };
+}
+
+/** Recording FCM fake with programmable result. */
+export function fakeFcm(result: FcmSendResult | (() => FcmSendResult)): FcmClient & { calls: Array<{ token: string; payload: PushPayload }> } {
+  const calls: Array<{ token: string; payload: PushPayload }> = [];
+  return {
+    calls,
+    async send(token, payload) {
+      calls.push({ token, payload });
+      return typeof result === 'function' ? result() : result;
+    },
+  };
+}
+
+export function fakeMailer(opts: { fail?: boolean } = {}): Mailer & { calls: Array<{ to: string; content: EmailContent }> } {
+  const calls: Array<{ to: string; content: EmailContent }> = [];
+  return {
+    calls,
+    async send(to, content) {
+      if (opts.fail) throw new Error('smtp down');
+      calls.push({ to, content });
+    },
+  };
+}