feat(events): add transactional booking outbox

[fredericklamar342-prog]

Summary

• Add a PostgreSQL outbox written in the same transaction as booking and audit records; appointment.booked is the first event producer.
• Dispatch events after commit using FOR UPDATE SKIP LOCKED, lease stale claims, and apply bounded exponential retries with dead-lettering after five attempts.
• Make booking notifications idempotent with a unique notification source-event id; expose sanitized dead-letter metadata only to admins.
• Document the at-least-once contract, migration, worker, and API.

Shared prerequisite

This branch includes the notification inbox implementation from PR #167, which is required for the booking notification handler. Please merge #167 first. After it lands, this branch may need rebasing to remove the shared prerequisite commit from this PR's diff.

Tests

Passed locally:

• npm run prisma:generate
• npm run audit:prod
• npm run typecheck
• npm test (96 passed)
• npm run test:integration (171 passed)
• npm run build

The broad npm run test:all command also includes the separate live-testnet payments suite; its setup fails when its external-network tests are skipped. The CI workflow uses the unit and self-contained integration commands listed above and does not include that directory.

Architecture and migration

Adds OutboxEvent and a nullable unique Notification.sourceEventId field. Apply the new Prisma migration with the normal migration deploy process. Events are at-least-once; handlers must remain idempotent. Dead-letter responses omit payloads and expose only stable error codes and event metadata.

Closes #94

[drips-wave]

@fredericklamar342-prog Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits