chore(deps): upgrade NestJS 10.x → 11.x (closes #754)

[goodness-cpu]

Summary

This PR performs the dedicated major-version upgrade of @nestjs/common,
@nestjs/core, @nestjs/config, @nestjs/passport,
@nestjs/platform-express, @nestjs/websockets, and the rest of the NestJS
ecosystem from v10 → v11, as tracked in issue #754.

NestJS 11 requires Node.js 20+ and brings the surrounding platform packages
(Express, Multer, Apollo Server, keyv, ts-morph, path-to-regexp) to their
current major versions. They are all bumped in this single, dedicated PR so
that the ecosystem stays internally consistent.

What changed

Framework packages (dependencies)

• @nestjs/common, core, platform-express, platform-socket.io, websockets, testing → ^11.1.27
• @nestjs/cli → ^11.0.23, @nestjs/schematics → ^11.1.0
• @nestjs/passport → ^11.0.5, @nestjs/config → ^4.0.4
• @nestjs/schedule stays at ^6.1.3 (already NestJS 11 compatible)
• @nestjs/swagger → ^11.4.4
• @nestjs/cache-manager → ^3.1.3

GraphQL/Apollo (forced by @nestjs/apollo@13)

• @nestjs/apollo, @nestjs/graphql → ^13.4.2
• @apollo/server → ^5.5.1 (peer dep)

Transitive dependencies (now required by NestJS 11 peer chain)

• express → ^5.2.1 (peer of @nestjs/platform-express@11)
• multer → ^2.2.0 (peer of @nestjs/platform-express@11)
• keyv → ^5.6.0 (peer of @nestjs/cache-manager@3)
• ts-morph → ^28.0.0 (peer of @nestjs/graphql@13)
• @types/express → ^5.0.6, @types/multer → ^2.0.0 (dev deps)

Runtime + CI

• engines.node: >=18.0.0 → >=20.0.0
• All actions/setup-node jobs in .github/workflows/ci.yml bumped from 18 → 20

Source adjustments

src/main.ts

• Runtime Node-version guard bumped from >= 18 to >= 20 with clearer
  error message so old CI images fail fast instead of crashing inside
  NestFactory.create with an unhandled engine error.
• Removed a duplicate app.useGlobalPipes(new ValidationPipe(...)) call
  that was silently overridden by a later call. A single ValidationPipe is
  now registered globally with transformOptions.enableImplicitConversion: true.

src/app.module.ts

• The consumer.apply(RequestIdMiddleware).forRoutes(*) catch-all
  middleware is preserved verbatim. NestJS absorbs forRoutes(*) at the
  routing layer (RouterExplorer) before Express 5 / path-to-regexp@8
  ever sees the string, so the wildcard remains valid.
• Removed playground: true from GraphQLModule.forRoot(...). Apollo
  Server v5 (@apollo/server@5, peer dep of @nestjs/apollo@13) drops
  the classic GraphQL Playground in favour of Apollo Sandbox, which is
  now the default landing page.

Validation

Step	Result
npm install	succeeds (see note below)
npm run build	exit 0
npm test	224 passed, 2 skipped (pre-existing), 0 failed across 34 suites (+ 1 pre-existing skipped suite)

npm install emits an ERESOLVE peer-dep warning for
@apollo/server-plugin-landing-page-graphql-playground@4 (a transitive
dep of @nestjs/apollo@13). npm auto-resolves it. The plugin is harmless
on its own — it is only loaded when the legacy playground: true flag is
set, which we removed; Apollo Server v5 ships Apollo Sandbox instead.

Out of scope (intentionally NOT changed in this PR)

• cache-manager-redis-store@^3.0.1: this is a cache-manager@5 store and
  is already mismatched against the cache-manager@7 stack used by
  @nestjs/cache-manager@3. That breakage predates [D1] Upgrade NestJS 10.x → 11.x #754 and is left for a
  follow-up issue.
• README / .env.example references to Node >=18: optional cosmetic
  follow-up.

Risk

Major (as flagged in #754). Scope was contained to a single dedicated PR
per the issue. engines.node is now >=20.0.0, the runtime guard and
CI both enforce it, and the build + full Jest suite pass on Node v24.

closes #754

[drips-wave]

@goodness-cpu Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits