feat(M01-A): 锁定后端依赖并验证HTTP健康检查

backend/package.json

@@ -3,6 +3,10 @@
   "version": "0.1.0",
   "private": true,
   "type": "module",
+  "engines": {
+    "node": ">=20.0.0",
+    "npm": ">=10.0.0"
+  },
   "scripts": {
     "dev": "tsx watch src/server.ts",
     "build": "tsc -p tsconfig.json",
@@ -10,10 +14,9 @@
     "test": "node tests/backend-contract.test.mjs"
   },
   "dependencies": {
-    "@fastify/cors": "^9.0.1",
-    "@fastify/rate-limit": "^9.1.0",
-    "fastify": "^4.28.1",
-    "kysely": "^0.27.4",
+    "@fastify/cors": "^11.2.0",
+    "@fastify/rate-limit": "^11.0.0",
+    "fastify": "^5.8.5",
     "mysql2": "^3.11.3",
     "pino": "^9.4.0",
     "zod": "^3.23.8"
@@ -22,5 +25,9 @@
     "@types/node": "^20.17.6",
     "tsx": "^4.19.2",
     "typescript": "^5.6.3"
+  },
+  "overrides": {
+    "fast-uri": "3.1.2",
+    "toad-cache": "3.7.0"
   }
 }

backend/tests/backend-contract.test.mjs

@@ -7,10 +7,13 @@ const root = dirname(dirname(fileURLToPath(import.meta.url)));
 const read = (path) => readFileSync(join(root, path), 'utf8');
 
 const packageJson = JSON.parse(read('package.json'));
-assert.equal(packageJson.dependencies.fastify.startsWith('^4.'), true);
+assert.equal(packageJson.engines.node, '>=20.0.0');
+assert.equal(packageJson.dependencies.fastify.startsWith('^5.'), true);
+assert.equal(packageJson.dependencies['@fastify/cors'].startsWith('^11.'), true);
+assert.equal(packageJson.dependencies['@fastify/rate-limit'].startsWith('^11.'), true);
 assert.equal(packageJson.dependencies.zod.startsWith('^3.'), true);
 assert.equal(packageJson.dependencies.mysql2.startsWith('^3.'), true);
-assert.equal(packageJson.dependencies.kysely.startsWith('^0.'), true);
+assert.equal(packageJson.dependencies.kysely, undefined);
 
 const tsconfig = JSON.parse(read('tsconfig.json'));
 assert.equal(tsconfig.compilerOptions.strict, true);