fix(dataplane): reject events without a delivery target and honor app_id fanout

[mekilis]

Summary

• POST /v1/projects/{id}/events with neither endpoint_id nor the deprecated app_id alias previously returned 201 and queued an event the worker could never deliver; the request is now rejected with 400 at validation time.
• app_id is resolved against project-scoped endpoints and rejected with 400 when it resolves to none, mirroring the existing endpoint_id existence check, and it is now forwarded to the worker task so accepted app_id requests actually resolve endpoints.
• CreateSubscription is set unconditionally for this handler, so app_id addressing auto-provisions catch-all subscriptions the same way endpoint_id does.
• The worker's findSubscriptions returned early after provisioning the first subscription-less endpoint, so multi-endpoint app_id fanout delivered to only one endpoint; it now continues so every resolved endpoint gets its catch-all subscription.

Test plan

• go test ./api/models/ (validation: missing target rejected, endpoint_id-only and app_id-only accepted)
• go test ./api/ integration tests (400 on missing target, 400 on app_id with no endpoints, app_id fanout delivers to all endpoints)
• go test ./worker/task/ (multi-endpoint provisioning continues past the first subscription-less endpoint)
• gofmt, go vet, golangci-lint clean on touched packages

Fixes PDE-928

---

Note

Medium Risk
Changes event intake validation (clients that omitted targets no longer get 201) and worker subscription resolution for multi-endpoint app_id fanout, both on the core outbound event path.

Overview
POST /v1/projects/{id}/events no longer accepts requests with neither endpoint_id nor deprecated app_id: validation returns 400 (please provide an endpoint ID) instead of queuing undeliverable events.

For app_id addressing, the handler now mirrors endpoint_id checks: it resolves endpoints in the project and returns 400 when none exist (app ID has no configured endpoints). Accepted requests pass AppID into the create-event worker task, always set CreateSubscription: true, and auto-provision catch-all subscriptions for subscription-less endpoints the same way as direct endpoint targeting.

In the worker, findSubscriptions no longer stops after the first subscription-less endpoint when auto-provisioning; it continues so multi-endpoint app_id fanout provisions catch-all subscriptions and delivery for every resolved endpoint, not just the first.

^{Reviewed by Cursor Bugbot for commit caa1730. Bugbot is set up for automated code reviews on this repo. Configure here.}

[linear]

PDE-928

[cursor]

Current version of PR was reviewed by /review-bugbot on Jul 20, 15:56 GMT+1. It flagged 0 findings.

^{Bugbot on commit 18d60f4 is skipped.}