feat: add resilient local listener CLI

[dakdevs]

Summary

• add revocable, hash-only API tokens for CLI authentication
• add tenant-scoped claim, ACK, NACK, and heartbeat endpoints
• add a Bun CLI that creates or selects a hook and forwards deliveries to localhost
• preserve binary bodies and signature headers while filtering hop-by-hop headers
• expose the CLI from the repository root for direct GitHub installation

Verification

• bun run lint
• bun run prettier:check
• bun run typecheck
• bun test (42 passing)
• bun run test:e2e
• bun run build
• bun run db:generate (no drift)

[dakdevs]

Superseded by #8, which is merged into main.