fix: require verified GBrain write receipts

[irresi]

Summary

• require a documented successful GBrain put_page receipt before committing a durable inbox event
• accept created_or_updated and idempotent skipped; fail closed on malformed or unknown responses
• classify Composio webhook authentication/replay errors using the actual typed error codes
• keep signed malformed payloads as HTTP 400 while authentication failures return a generic HTTP 401

Verification

• bun run check — Biome, TypeScript, 51 tests, production build
• bun audit — no vulnerabilities
• gitleaks git --staged --redact --no-banner — no leaks
• targeted tests demonstrate RED before implementation and GREEN after

Scope

No Composio, Gmail, GBrain data, trigger, OAuth, or deployment configuration changed.