feat(router): add ReBAC-protected event-to-socket relays

[JohnChantz]

What kind of change does this PR introduce?

• Bugfix
• Feature
• Code style update
• Refactor
• Build-related changes
• Other (please describe)

Does this PR introduce a breaking change?

• Yes
• No

The PR fulfills these requirements:

• It's submitted to the main branch
• When resolving a specific issue, it's referenced in the PR's description (e.g. fix #xxx, where "xxx" is the issue number)

If adding a new feature, the PR's description includes:

• A convincing reason for adding this feature

Other information:

Split from #1594 (1/3). Follow-ups: Mongo live updates, then SQL live updates.

Apps need to forward exact Redis bus events to Socket.io without REST polling. Relays stay authorization-aware: subscribe is allowed only when User:<id> has the configured permission on <resourceType>:<resourceId>.

Summary

Admin-configured, ephemeral mappings from an exact Redis bus channel to a templated Socket.io event on /events/. Clients subscribe with relayId + resourceId; rooms are derived server-side. Admin CRUD is at /router/event-relays. Emission is local-only so HA instances do not duplicate.

Companion Admin UI: ConduitPlatform/Conduit-UI#327

Test plan

• Router event-relay unit tests (pnpm --filter @conduitplatform/router test): channel matching, template rendering, ReBAC authorize, subscribe/unsubscribe rooms
• Create/edit/disable/delete a relay via Admin API
• Subscribe with a user token that has the relation → receive the templated payload
• Subscribe without the relation → PERMISSION_DENIED
• Confirm inactive relays and mismatched bus event names do not emit

[JohnChantz]

Stack: this PR → #1601 (Mongo live updates) → #1602 (SQL live updates). Split from #1594.