fix(api): NATS subscriptions moved to onApplicationBootstrap — they silently no-oped before connect

Production bug caught live: provider onModuleInit order put bridge/
consumer subscription hooks BEFORE NatsService finished connecting, so
every subscribe() hit the [OFFLINE] no-op path — the WS bridge has been
dead-on-boot in every production build, and the new v2 consumer never
saw a heartbeat (server_connections stayed empty under a live agent).
onApplicationBootstrap is guaranteed to run after all module inits,
including the awaited NATS connect.

The new CI contract suite fails on exactly this class of bug.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

backend-nest/src/services/host-agent-consumer.service.ts

@@ -1,4 +1,4 @@
-import { Injectable, Logger, OnModuleInit } from '@nestjs/common';
+import { Injectable, Logger, OnApplicationBootstrap } from '@nestjs/common';
 import { Interval } from '@nestjs/schedule';
 import { InjectRepository } from '@nestjs/typeorm';
 import { Repository } from 'typeorm';
@@ -17,7 +17,7 @@ import { License } from '../entities/license.entity';
  * staleness sweep marks hosts offline when heartbeats stop arriving.
  */
 @Injectable()
-export class HostAgentConsumerService implements OnModuleInit {
+export class HostAgentConsumerService implements OnApplicationBootstrap {
   private readonly logger = new Logger(HostAgentConsumerService.name);
 
   /** licenseId -> cache expiry epoch-ms. Positive = exists, absent = unknown. */
@@ -39,7 +39,9 @@ export class HostAgentConsumerService implements OnModuleInit {
     private readonly licenseRepository: Repository<License>,
   ) {}
 
-  onModuleInit() {
+  // Bootstrap, not module-init: subscriptions registered before NatsService
+  // finished connecting silently no-op (see NatsBridgeService note).
+  onApplicationBootstrap() {
     this.nats.subscribe('corrosion.*.host.heartbeat', (data, subject) => {
       const licenseId = subject.split('.')[1];
       void this.onHeartbeat(licenseId).catch((err) =>