escala 1: Meteor 1.6.1.1 -> 1.8.3

meteor update --release 1.8.3 + Babel beta->stable fix.

- Core packages bumped (meteor 1.9.3, ecmascript 0.13.2, mongo 1.7.0,
  npm-mongo 3.2.0 driver — still compatible with Mongo 3.2 server).
- Fix boot failure 'Cannot find @babel/runtime/helpers/objectSpread2':
  upgraded @babel/runtime 7.0.0-beta.44 -> ^7.29.7 (stable 7.x; not 8.x).
- underscore auto-added, fetch/modern-browsers added by the release.

REST smoke test byte-identical to baseline. See UPGRADE.md.

UPGRADE.md

@@ -0,0 +1,91 @@
+# Meteor upgrade — 1.6.1.1 → 2.x (→ 3.x blocked)
+
+Incremental, verified upgrade of `todos-contra-el-fuego-web`. Branch:
+`meteor3-upgrade` (base `tcef-master`). Local commits only — no push until
+authorized.
+
+## ⚠️ Hard blocker for the final 3.x jump: MongoDB 3.2
+
+Production runs against the shared replica set **rsmain on MongoDB 3.2.11**.
+Meteor 3 ships the modern `mongodb` Node driver, which requires a server
+**≥ 4.2/4.4**. Meteor **2.x still works against Mongo 3.2**.
+
+Therefore this branch stops at the **highest stable 2.x** with everything green,
+and the `meteor update --release 3.x` step is **deliberately not taken** until
+the Comunes infra team upgrades rsmain (shared infra — coordinated in a separate
+phase, not unilaterally). The 2.x server code is migrated to async/await ahead
+of time so the final 3.x jump is mechanical.
+
+## ⚠️ Deploy-ordering dependency: notifications cutover
+
+The old push/email notification code was removed from the web (see the
+notifications commit) because it now lives in the **tcef-notifications**
+microservice. **Production must not run this build until tcef-notifications is
+emitting in prod** — otherwise users stop receiving notifications. The web
+deploy and the notifications cutover must be coordinated.
+
+## Safety net: REST smoke test
+
+`smoke/` is a standalone Node harness that calls every REST endpoint the Flutter
+app consumes, against a seeded local dev server, and diffs the responses against
+committed snapshots (`smoke/snapshots/`). See `smoke/README.md`.
+
+**Run after every escala — it must stay byte-identical:**
+
+```bash
+docker run -d --name tcef-mongo32 -p 27018:27017 mongo:3.2   # once
+export PATH="$HOME/.meteor:$PATH" MONGO_URL="mongodb://localhost:27018/fuegos"
+meteor --settings settings-development.json --port 3100 &     # dev server
+./smoke/smoke.sh                                              # seed + compare
+```
+
+## Escalas
+
+### Baseline — Meteor 1.6.1.1 (starting point)
+
+- Boots against Mongo 3.2 with `settings-development.json`.
+- Dev-enabling changes (do not affect production behavior):
+  - `IPGeocoder.js`: degrade gracefully when the MaxMind GeoLite2 DB is absent
+    (provisioned by cron in prod) instead of crashing at boot.
+  - `settings-development.json`: added dev-only `private.internalApiToken`
+    (`dev-smoke-token`) — the REST API only registers its routes when this is
+    set.
+- **Notifications code removed** (migrated to tcef-notifications): deleted
+  `notificationsObserver.js`, `notificationsProcess.js`, the "Process pending
+  notif" SyncedCron job, and the `node-gcm` dependency. `subsUnion.js` kept (it
+  feeds `subs-public-union`, consumed by the app).
+- REST smoke baseline captured here. ✅ green.
+
+### Escala 1 — 1.6.1.1 → 1.8.3  ✅ green
+
+```bash
+meteor update --release 1.8.3
+meteor npm install --save @babel/runtime@^7.26.0
+```
+
+Core packages bumped (highlights): `meteor` 1.8.6→1.9.3, `ecmascript`
+0.10.7→0.13.2, `modules` 0.11.6→0.14.0, `mongo` 1.4.7→1.7.0, `npm-mongo`
+2.2.34→**3.2.0** (mongodb driver 3.x — still fine against Mongo 3.2 server),
+`webapp` 1.5.0→1.7.5, `standard-minifier-js` →2.5.2. `underscore` auto-added
+(1.7 dropped it from meteor-base), `fetch` + `modern-browsers` added.
+
+**Breaking change — Babel beta → stable.** Boot failed with
+`Cannot find module '@babel/runtime/helpers/objectSpread2'`: the pinned
+`@babel/runtime@7.0.0-beta.44` predates helpers that 1.8's `ecmascript` emits.
+Fixed by upgrading to stable **7.x** (`@babel/runtime@^7.29.7`). Note: `@latest`
+resolves to `8.x`, which is too new for Meteor's 7-style helper layout — pin to
+`^7`.
+
+REST smoke test: **byte-identical to baseline.** ✅
+
+## Dependency debt (tracked, to resolve in the noted escala)
+
+| Dep | From | Target | Status |
+|---|---|---|---|
+| React / react-dom | 16.0 | 18 | pending (escala 1.11) |
+| raven / flowkey:raven | 2.4 | @sentry/node + @sentry/react | pending — DSN off until GlitchTip/Sentry back |
+| nodemailer | 4 | 6+ | pending |
+| Babel | 7 beta | 7 stable | pending (first escala that allows) |
+| i18next | 10 | current | evaluate cost; pin + note as debt if it breaks a lot |
+| Leaflet | 1.3.1 | current | evaluate cost; pin + note as debt if it breaks a lot |
+| node-gcm | 1.0.2 | — | ✅ removed (dead API, moved to microservice) |