fix(webhooks): make SNS processing replay-safe

[vladbisceanu]

SNS deliveries are currently acknowledged after partial failures and can replay side effects when processing fails between database writes. Any AWS account can also send a validly signed SNS envelope unless the receiver authorizes the topic.

This patch:

• requires an exact, comma-separated SNS_TOPIC_ARNS allowlist and checks it before certificate or confirmation URL I/O
• durably claims the signed outer SNS MessageId, with a lease for abandoned processing and a seven-day receipt window
• commits email/contact/event effects and receipt completion in one transaction
• returns 5xx for processing and subscription-confirmation failures so SNS retries
• stores workflow events before dispatch and retries aged pending events from the existing maintenance worker
• preserves the current campaign dirty-stat sweep on upstream next

Existing event rows are backfilled as processed during migration. New deployments must set SNS_TOPIC_ARNS; the self-hosting examples and CI environment document the contract.

Verification:

• focused RSA signature and SNS webhook suite: 17/17 tests
• API ESLint: 0 errors, 7 existing warnings
• fresh-schema migration validation on the fork candidate
• security-only diff review: no findings

The fork tracks tighter event-dispatch claiming and removal of swallowed workflow-start errors as separate follow-ups, so this PR stays scoped to durable SNS ingestion and retry behavior.