refactor(ts): put getState/loadState on the Resource contract, mirroring Python's base (A3) - #800

…ing Python's base

`snapshot/state.ts` cast every mount's resource into `{ getState }` and
called it unconditionally, so a resource without one was a runtime crash
at save time rather than a compile error. postgres and mongodb — both
registry-mountable, in node and browser — had none, and snapshotting such
a mount died with `resource.getState is not a function`.

Structure follows Python's, which already had all of this:

- `BaseResource` gains `getState()` returning `{type: this.kind}` and a
  no-op `loadState()`, the twins of `BaseResource.get_state` /
  `load_state`. `kind` moves onto the base as abstract so the default can
  spell itself, mirroring Python's `name`.
- `Resource` declares both non-optionally, so the two casts in
  `snapshot/state.ts` go away.
- The eight config-backed resources that had no state — chroma, dify,
  qdrant (core), postgres, mongodb (node + browser), lancedb — now carry
  their config, redacted. Inheriting the bare default would be worse than
  crashing: with no `<REDACTED>` marker,`resourceStateRequiresOverride`
  returns false and `buildMountArgs` substitutes an empty RAMResource,
  turning a live database mount into an empty directory on load.
- Redacted fields were taken from Python's own `secret_field_names`, not
  guessed: qdrant/lancedb `apiKey`, postgres `dsn`, mongodb `uri`, dify
  `apiKey` (Python masks it in `get_state` rather than on the model),
  chroma none.
- `HfResource` re-narrows `getState` to abstract so the bare default
  cannot reach a Hub resource. Python has no shared Hub base; its four
  resources each spell `get_state`.
- Test fakes that stood up a `Resource` by hand now extend `BaseResource`
  like real resources do, so they inherit the default instead of carrying
  a stub. The three that cannot (two object literals, and the bare class
  that exists to have no `storageId`) spell the pair.
- mem0/onedrive/sharepoint swap `Record<string, unknown>` for named state
  types, joining the ~35 resources that already had them.

Tests: a registry-derived sweep over the six database backends asserts
getState/loadState exist and the credential is masked, plus an end-to-end
`toStateDict` over a postgres mount. Python gains the twin sweep in
`tests/resource/test_state_round_trip.py` — it passes as-is, which is the
point: this closes a TypeScript-only gap.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

The interface I added to `resource/base.ts` was a byte-identical copy of
a private one that already sat in `workspace/snapshot/types.ts` feeding
`ResourceState`. Snapshot types now import the exported one, so the
Resource contract and the snapshot format name one shape.

The doc comment now says what the two keys are for rather than
paraphrasing: `type` is the registry name Python's `_resource_class_for`
looks up before falling back to the mount's `resource_class` import path,
and `config` is what `resourceStateRequiresOverride` scans. It also
records why the literal twin of Python's `dict[str, Any]` does not work
here — a TS interface has no implicit index signature, so
`Record<string, unknown>` would reject every named `XResourceState`.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

… load as RAM

Both from the codex review of strukto-ai#800, both verified against Python first.

P2 — a null secret was being masked. `redactValueWithSchema` returns
null *before* it asks whether a field is secret, mirroring Python's
`if value is None: continue` in `_walk_config_dump`. The hand-written
qdrant and lancedb redactors masked unconditionally, and both keys are
`string | null`, so a keyless local Qdrant or an on-disk LanceDB got a
`<REDACTED>` marker for a credential it never had — making
`Workspace.load` demand a fresh config for a self-contained snapshot.
`RedactedConfig<T, K>` now keeps null in the redacted twin when the
source allows it, so the type says this too.

P1 — chroma has no credential, so its state carried no marker, so
`buildMountArgs` handed back a `RAMResource` and a /chroma mount loaded
as an empty local directory. The cause is broader than chroma:
TypeScript rebuilds *nothing* from state, because core cannot import
`buildResource` (it lives in node/browser), while Python reconstructs the
class from `resource_state["type"]` via its registry
(`_resource_class_for`). Until core gets a resource factory,
`resourceStateRequiresOverride` also honors an explicit
`needs_override`, and the six config-backed resources set it — so the
mount refuses to load rather than coming back empty. Python already
writes that field on four resources and reads it nowhere; TypeScript now
reads it, which also protects Python-written snapshots loaded in TS.

Tests: keyless lancedb/qdrant cases on both sides (Python passes as-is,
which is the proof the null rule was already its behavior), and the
registry sweep now asserts every config-backed backend demands a
resource at load.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>