feat: add write hooks server support through phase 4

[skgbafa]

Summary

• add signed hook tickets and shared SSE streaming for KV, SQL, and DuckDB write events
• add webhook CRUD, encrypted secret handling, dispatcher-backed durable delivery, and phase 4 SQL/DuckDB enqueue-on-success behavior
• factor shared write-hook matching and delivery-id logic for consistent SSE and webhook filtering

Verification

• cargo fmt --all -- --check
• TMPDIR=/mnt/HC_Volume_105362075/tmp/write-hooks-node CARGO_TARGET_DIR=/mnt/HC_Volume_105362075/cargo-target/write-hooks-node OPENSSL_NO_VENDOR=1 CARGO_INCREMENTAL=0 cargo check -j 8 -p tinycloud-core -p tinycloud-node-server
• TMPDIR=/mnt/HC_Volume_105362075/tmp/write-hooks-node CARGO_TARGET_DIR=/mnt/HC_Volume_105362075/cargo-target/write-hooks-node OPENSSL_NO_VENDOR=1 CARGO_INCREMENTAL=0 cargo clippy -j 8 -p tinycloud-core -p tinycloud-node-server --all-targets -- -D warnings
• TMPDIR=/mnt/HC_Volume_105362075/tmp/write-hooks-node CARGO_TARGET_DIR=/mnt/HC_Volume_105362075/cargo-target/write-hooks-node OPENSSL_NO_VENDOR=1 CARGO_INCREMENTAL=0 cargo test -j 8 -p tinycloud-core --lib write_hooks::tests -- --nocapture
• TMPDIR=/mnt/HC_Volume_105362075/tmp/write-hooks-node CARGO_TARGET_DIR=/mnt/HC_Volume_105362075/cargo-target/write-hooks-node OPENSSL_NO_VENDOR=1 CARGO_INCREMENTAL=0 cargo test -j 8 -p tinycloud-node-server --lib routes::tests -- --nocapture
• TMPDIR=/mnt/HC_Volume_105362075/tmp/write-hooks-node CARGO_TARGET_DIR=/mnt/HC_Volume_105362075/cargo-target/write-hooks-node OPENSSL_NO_VENDOR=1 CARGO_INCREMENTAL=0 cargo test -j 8 -p tinycloud-node-server --lib routes::hooks::tests -- --nocapture
• TMPDIR=/mnt/HC_Volume_105362075/tmp/write-hooks-node CARGO_TARGET_DIR=/mnt/HC_Volume_105362075/cargo-target/write-hooks-node OPENSSL_NO_VENDOR=1 CARGO_INCREMENTAL=0 cargo build -j 8 --bin tinycloud
• ROCKET_PORT=9000 TMPDIR=/home/sam/github/rapid/worktrees/tinycloud-node/feat/write-hooks-phase1/data/tmp CARGO_TARGET_DIR=/mnt/HC_Volume_105362075/cargo-target/write-hooks-node OPENSSL_NO_VENDOR=1 CARGO_INCREMENTAL=0 /mnt/HC_Volume_105362075/cargo-target/write-hooks-node/debug/tinycloud
• curl -sf http://localhost:9000/info

Notes

• For live local runs, runtime TMPDIR must stay on the same filesystem as the node data/ directory to avoid cross-device persist(...) failures in file-backed KV staging.