fix(templates): stop class fields shadowing Sequelize's attribute accessors

[Bccorb]

Sequelize installs its attribute getters and setters on the prototype. public id!: string is emitted as an own property initialised to undefined, which shadows them: user.id reads undefined while user.get("id") returns the row's value. declare emits no field at all, so the accessors survive.

Both API starters are changed, express and fastify. The diff is five lines per model and nothing else.

This is a guard, not a repair

Whether the field is emitted depends on useDefineForClassFields, which follows target. Both starters compile at target: ES2020 in tsconfig.json, and tsconfig.build.json only extends it, so dev (tsx) and prod (tsc) agree. Below ES2022 a field with a definite assignment assertion and no initialiser is erased entirely, so nothing is shadowed today.

Confirmed by building this branch:

$ npm run build && sed -n '/class User extends Model/,/^}/p' dist/models/user.js
export class User extends Model {
}

And confirmed in both directions with a live model, no database needed:

target ES2020:  public id!:  .id = "abc-123"   .get('id') = "abc-123"
target ES2022:  public id!:  .id = undefined   .get('id') = "abc-123"
                declare id:  .id = "abc-123"   .get('id') = "abc-123"
(sequelize) Warning: Model "Old" is declaring public class fields for attribute(s): "id", "email".

So this does not fix behaviour anyone is seeing right now. It matters because it disarms a target bump: at ES2022 every attribute on every model returns undefined, and the first symptom is a query built with an undefined parameter on any handler that filters by req.appUser.id, which requireUser assigns from a Sequelize instance. Moving to a Node 24 baseline is an ordinary thing to do and would trigger it silently.

If you have actually observed WHERE parameter "user_id" has invalid "undefined" value, this branch will not make it go away and the cause is elsewhere.

Follow-up worth considering

Nothing in the repo now states the rule, so the pattern is carried by example only. The generation pipeline reads api/models/user.ts as its worked model example on every run, and reference.ts has a "Conventions to match" block where models are already described. A one line rule there ("attributes are always declare, never public x!: T") would make new generated models safe by rule rather than by imitation.

Checks

npm run validate passes. npm run check (typecheck, lint, format:check, test) and npm run build pass in both API starters.

Note for review

This branch carries two commits because git commit --amend was unavailable when the first fixup was prepared. The earlier commit's message contains an em dash, which the working standards forbid. Squash on merge and both go away.