feat(processing): add distributed session coordination (closes #216)

[GWorld57]

Implements #216.

When horizontally scaling the worker, two pods polling the API in parallel would otherwise register StreamSessions for the same streamId and double-publish every event. This change wires a LockManager in front of SessionRegistry so each stream is claimed atomically before a session is created.

Two backends ship:

• MemoryLockManager (default, per-process) — no infra cost for tests + single-replica deployments.
• PostgresLockManager (LOCK_BACKEND=postgres) — fronts a small stream_locks table that the worker bootstraps on startup. Acquisition is a single atomic UPSERT; renewal is a guarded UPDATE; release/eviction handle TTL expiry for crashed workers without a separate Redis broker.

Notes

• LOCK_BACKEND, DATABASE_URL, and LOCK_TTL_MS added to .env validation and .env.example.
• pg and @types/pg added as worker deps.
• SessionRegistry.route() is now async; worker.ts pollOnce() wraps the call in try/catch + continue so a transient coordinator failure cannot kill the worker.
• worker.ts pollOnce() deduplicates identical routing errors within a 30s window (LRU-capped at 100 keys by oldest-lastLoggedAtMs) so a sustained DB outage does not flood stderr.

Verification

• tsc --noEmit clean.
• jest --runInBand: 11 suites, 88 tests, all green.

Closes #216

[Xhristin3]

Big change, but the abstraction (memory vs postgres backends behind one LockManager interface) is clean, and the new tests cover both. The pnpm-lock bump matches the new pg dependency. Approving and merging.