feat: WebSocket relay SQL optimization, error recovery, security audit, and rate limiting

[davedumto]

Summary

• [Backend] Optimize SQL queries in Websocket Relay #919 — SQL optimization (WebSocket relay): websocket-relay-queries.js adds getRecentEvents (paginated, descending), batchInsertEvents (single multi-row INSERT), and dequeueNextEvent (SELECT … FOR UPDATE SKIP LOCKED). All three wrap queries in SET LOCAL statement_timeout = '5s'. Index recommendations are documented in the file header.
• [Backend] Enhance error recovery for Websocket Relay #920 — Error recovery: websocket-relay-recovery.js provides reconnectWithBackoff (exponential backoff + jitter), CircuitBreaker (CLOSED/OPEN/HALF_OPEN states, configurable threshold + reset timeout), DeadLetterQueue (failed messages with error metadata + retry count), and getRelayHealth (single snapshot for monitoring).
• [Backend] Conduct security audit on Websocket Relay #921 — Security audit: websocket-relay-security.js adds validateOrigin (exact-match whitelist, no wildcards), enforceMessageSizeLimit (64 KiB default, works on strings/Buffers/objects), verifyRelayToken (HS256-only jsonwebtoken wrapper), sanitizeRelayMessage (strips unknown fields, requires type), and auditRelayEvent (structured JSON audit log).
• [Backend] Implement rate limiting for Payment Processor #922 — Rate limiting: payment-rate-limiter.js provides createPaymentRateLimiter — an in-memory sliding-window Express middleware with per-key tracking, X-RateLimit-* headers, 429 + retryAfter body, and automatic eviction of stale entries. No Redis dependency.

Test plan

• All 80 new vitest tests pass locally (npx vitest run src/lib/websocket-relay-queries.test.js src/lib/websocket-relay-recovery.test.js src/lib/websocket-relay-security.test.js src/middleware/payment-rate-limiter.test.js)
• Verify no regressions in existing test suite (npm test)

closes #919
closes #920
closes #921
closes #922