feat(security): persist indexer webhook idempotency

[220nightmore-spec]

Summary

• adds a processed_indexer_events Drizzle table and migration keyed by event_id
• replaces in-process indexer replay dedupe with an injected store backed by the new table in non-test environments
• keeps signature and payload validation before idempotency recording, and fails closed with 503 if replay protection is unavailable
• documents durable replay protection in docs/SECURITY.md and docs/data-model.md
• disables declaration output for the backend app build so npm run build/tsc no longer fails on TS2883 portable declaration paths from Express/Drizzle inferred exports

Closes #187

Validation

• pnpm run build
• pnpm exec jest --runInBand
• pnpm exec eslint src/services/eventIngestionService.ts src/services/__tests__/eventIngestionService.test.ts src/repositories/processedIndexerEventRepository.ts src/routes/webhooks/indexer.ts src/indexerWebhook.test.ts --max-warnings 0
• git diff --check