Phase 1: data pipeline (Postgres+Redis with in-memory fallback, mock telemetry publisher, WebSocket fan-out, hub /debug page)

- packages/db: postgres.js + ioredis wrapper, StateStore interface with
  InMemory + Postgres implementations, schema migration runner
- apps/api: refactored to use @kerbal-rt/db; live WebSocket hub subscribes
  to store changes and broadcasts to all clients
- apps/tools/mock-telemetry: Node script that generates realistic KSP
  state and POSTs to /api/v1/ingest at 1Hz (uses same keplerian math
  as the live-map renderer)
- apps/hub: new /debug page that connects to /api/v1/live and shows
  the live state
- ksp/README.md: documents Phase 1c (real kRPC bridge) and the two
  implementation options
- Tests: 17 total (5 kepler math, 5 db store, 5 API health/state,
  2 API WebSocket fan-out)

End-to-end verified: mock publisher → API → hub /debug page,
11 snapshots/5s over WebSocket, vessels advancing in mean anomaly.

apps/api/src/app.ts

@@ -7,10 +7,17 @@ import { cors } from 'hono/cors';
 import { logger } from 'hono/logger';
 import { UniverseSnapshotSchema } from '@kerbal-rt/shared-types';
 import { z } from 'zod';
-import { state } from './state.js';
+import type { StateStore } from '@kerbal-rt/db';
 
-export function buildApp() {
+export interface AppDeps {
+  store: StateStore;
+  /** The expected ingest API key, or null to disable auth (dev only). */
+  ingestApiKey: string | null;
+}
+
+export function buildApp(deps: AppDeps) {
   const app = new Hono();
+  const { store, ingestApiKey } = deps;
 
   app.use('*', logger());
   app.use('*', cors({ origin: process.env.CORS_ORIGIN?.split(',') ?? '*' }));
@@ -21,6 +28,7 @@ export function buildApp() {
       ok: true,
       service: 'kerbal-rt-api',
       version: '0.1.0',
+      store: store.constructor.name,
       ts: new Date().toISOString(),
     }),
   );
@@ -29,15 +37,22 @@ export function buildApp() {
   const IngestAuth = z.object({ 'x-api-key': z.string() });
 
   app.post('/api/v1/ingest', async (c) => {
-    const headerParse = IngestAuth.safeParse(
-      Object.fromEntries(Array.from(c.req.raw.headers.entries())),
-    );
-    if (!headerParse.success) {
-      return c.json({ error: true, code: 'UNAUTHORIZED', message: 'Missing API key' }, 401);
-    }
-    if (headerParse.data['x-api-key'] !== process.env.INGEST_API_KEY) {
-      return c.json({ error: true, code: 'FORBIDDEN', message: 'Bad API key' }, 403);
+    if (ingestApiKey) {
+      const headerParse = IngestAuth.safeParse(
+        Object.fromEntries(Array.from(c.req.raw.headers.entries())),
+      );
+      if (!headerParse.success) {
+        return c.json({ error: true, code: 'UNAUTHORIZED', message: 'Missing API key' }, 401);
+      }
+      if (headerParse.data['x-api-key'] !== ingestApiKey) {
+        return c.json({ error: true, code: 'FORBIDDEN', message: 'Bad API key' }, 403);
+      }
+    } else if (process.env.NODE_ENV === 'production') {
+      // Belt and suspenders: never allow unauthenticated ingest in prod
+      // even if the env var is missing.
+      return c.json({ error: true, code: 'UNAUTHORIZED', message: 'Ingest disabled' }, 401);
     }
+
     const body = await c.req.json();
     const parsed = UniverseSnapshotSchema.safeParse(body);
     if (!parsed.success) {
@@ -51,23 +66,28 @@ export function buildApp() {
         400,
       );
     }
-    state.applySnapshot(parsed.data);
-    return c.json({ error: false, data: { ok: true, ts: new Date().toISOString() } });
+    const result = await store.applySnapshot(parsed.data);
+    return c.json({
+      error: false,
+      data: { ok: true, rowsInserted: result.rowsInserted, ts: new Date().toISOString() },
+    });
   });
 
   // ─── read-only endpoints ───────────────────────────────────────────────
-  app.get('/api/v1/state', (c) => {
-    const snap = state.latestSnapshot();
+  app.get('/api/v1/state', async (c) => {
+    const snap = await store.latestSnapshot();
     if (!snap) return c.json({ error: true, code: 'NO_DATA', message: 'No snapshot yet' }, 503);
     return c.json({ error: false, data: snap });
   });
 
-  app.get('/api/v1/bodies', (c) => c.json({ error: false, data: state.latestBodies() }));
+  app.get('/api/v1/bodies', async (c) => c.json({ error: false, data: await store.listBodies() }));
 
-  app.get('/api/v1/vessels', (c) => c.json({ error: false, data: state.latestVessels() }));
+  app.get('/api/v1/vessels', async (c) =>
+    c.json({ error: false, data: await store.listVessels() }),
+  );
 
-  app.get('/api/v1/vessels/:id', (c) => {
-    const v = state.getVessel(c.req.param('id'));
+  app.get('/api/v1/vessels/:id', async (c) => {
+    const v = await store.getVessel(c.req.param('id'));
     if (!v) return c.json({ error: true, code: 'NOT_FOUND', message: 'Vessel not found' }, 404);
     return c.json({ error: false, data: v });
   });