feat(router): add ReBAC-protected event-to-socket relays

[JohnChantz]

What kind of change does this PR introduce?

• Bugfix
• Feature
• Code style update
• Refactor
• Build-related changes
• Other (please describe)

Does this PR introduce a breaking change?

• Yes
• No

The PR fulfills these requirements:

• It's submitted to the main branch
• When resolving a specific issue, it's referenced in the PR's description (e.g. fix #xxx, where "xxx" is the issue number)

If adding a new feature, the PR's description includes:

• A convincing reason for adding this feature

Other information:

Summary

• Adds Router event relays: exact Redis bus events are forwarded as templated Socket.io messages on /events/, with resource-scoped rooms, fail-closed ReBAC, and local-only HA emission.
• Admin CRUD for relays (/router/event-relays), plus docs and metrics.
• Companion Admin UI: feat(router): add event relays administration page Conduit-UI#321

Test plan

• cd modules/router && npm test (templating, path safety, validation, pagination/search, channel reconcile, ReBAC allow/deny, local-only emit)
• Create/edit/disable/delete a relay via Admin API
• Subscribe with a user token that has the relation → receive the templated payload
• Subscribe without the relation → PERMISSION_DENIED
• Confirm inactive relays and mismatched bus event names do not emit