Webhook-to-SSE gateway with hierarchical topic routing and signature verification

Pluggable pub/sub backend for multi-replica support master

Wicket was single-replica only — the Broker fanned out events directly to local SSE subscriber channels, so only the replica that received a POST could deliver to its subscribers. This adds a Backend interface that decouples event distribution from local subscriber management, with two implementations: - MemoryBackend (default): same behavior as before, ring buffer + in-process fan-out. Extracts RingBuffer and pathMatches from broker.go. - RedisBackend: uses Redis pub/sub for cross-replica delivery and a Redis LIST for replay buffering. Pipelined LPUSH+LTRIM+PUBLISH keeps it atomic. Tested with miniredis, including a two-backend cross-replica delivery test. The Broker now takes a Backend and has a Start(ctx) method that reads from the backend's event channel. A monotonic sequence counter prevents duplicate delivery when backend-buffered events race with Last-Event-ID replay. New -backend and -redis-url CLI flags wire it up in main. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>