feat: NATS real-time event system with auth callout, mTLS and model publishing

• Auth callout service: NatsAuthCalloutService validates every NATS connection via $SYS.REQ.USER.AUTH. Agents authenticated via events_token (compute/storage/network), browser clients via OAuth tokens. Returns NKey-signed two-layer JWTs with scoped pub/sub permissions.
• NkeyHelper: Ed25519 NKey encoding, JWT signing, and base32 utilities — no external NKey library dependency.
• Platform mTLS: NatsService and NatsAuthListenerCommand both present NATS_TLS_CERT/NATS_TLS_KEY client certificates for mTLS on port 4222.
• Auth listener: NatsAuthListenerCommand uses subscribeQueue (queue group nats-auth-callout) so multiple container instances share load without duplicate responses. Reconnects automatically on connection drop.
• Model event publishing: Events::fire() auto-dispatches NatsPublisherJob when NATS is enabled. Job resolves Fractal transformer from model class name, transforms the model, publishes to client.{account_uuid}.evt.
• Multi-account subscriptions: OAuth clients get client.{uuid}.evt for every account in iam_account_user — account switching doesn't require reconnect.
• NatsService: Connects as auth-service (bypasses callout) for platform publish access.