feat(cli): add native Bun backend support and Dockerfile.bun (#11039)

⭐4 — Suporte de backend nativo Bun + Dockerfile.bun multi-stage + fallback dinâmico de driver SQLite (better-sqlite3 prioritário sob Bun, bun:sqlite fallback; Node preservado) + correção de estabilidade do DAST CI smoke.
Validado a fundo (worktree board sobre tip): bun-support 4/4, typecheck:core limpo, dashboard-typecheck OK (220 dentro do baseline), open-sse-typecheck OK (5 pré-existentes), gate de runtime OK sob Node, changelog-integrity OK, file-size/complexity/cognitive/dead-code OK. Verificado que o driver preserva a cadeia Node/falback conforme AGENTS.md; teste bun-support presente. Baselines de typecheck removidos são ratchet honesto (erros não existem mais).
OBS: destravei 2 base-reds do tip neste turno (push direto 7ffa3ef): movi o changelog fragment da #11050 da seção inválida breaking/ para fixes/, e rebaselinei AddApiKeyModal 1067->1073 (crescimento da #11056). Sem isso a #11039 e o resto da fila ficariam vermelhos.

.github/workflows/dast-smoke.yml

@@ -46,6 +46,7 @@ jobs:
         env:
           PORT: "20128"
           INJECTION_GUARD_MODE: block
+          REQUIRE_API_KEY: "false"
         run: |
           node dist/server.js > server.log 2>&1 &
           echo $! > server.pid
@@ -64,16 +65,20 @@ jobs:
           # those 302s as "the API accepted a schema-violating request" and the configured-off
           # 400 as "rejected a schema-compliant request". Documenting the flow in the spec is
           # still right (operators need it); fuzzing it is not what this smoke is for.
+          # /api/auth/login has brute-force rate limiting: repeated failed logins return 429,
+          # which Schemathesis flags as rejection of schema-compliant requests.
           schemathesis run docs/openapi.yaml --url http://localhost:20128 \
             --include-path-regex '^/v1/(chat/completions|models)$|^/api/(auth|keys)' \
-            --exclude-path-regex '^/api/auth/oidc/' \
+            --exclude-path-regex '^/api/auth/(oidc/|login)' \
             --max-examples 8 --workers 4 --checks all --max-response-time 30 \
             --request-timeout 20 --suppress-health-check all --no-color
+      - name: Install promptfoo
+        run: npm install -g promptfoo@0.122.0
       - name: promptfoo injection-guard (blocking)
         env:
           OMNIROUTE_URL: http://localhost:20128
           OMNIROUTE_API_KEY: not-needed-blocked-before-upstream
-        run: npx --yes promptfoo@latest eval -c promptfooconfig.yaml --no-cache
+        run: promptfoo eval -c promptfooconfig.yaml --no-cache
       - name: Stop server
         if: always()
         run: kill "$(cat server.pid)" || true