Harden shared runtime for production readiness

[Verma-Punit]

What changed

• adds durable queue retry, timeout, backoff, and failure logging for invoice email jobs
• prevents duplicate exception reporting and returns consistent JSON errors for API requests
• makes scheduled billing maintenance safe across multiple application servers
• adds Composer security auditing to CI
• refreshes Composer and npm lockfiles within existing constraints to remove known advisories

Why

Phase 3 requires the open-source runtime to remain the single source of truth while being safe to operate under asynchronous workers and horizontally scaled schedulers.

Impact

The shared runtime now has explicit production failure behavior and secure dependency locks. No hosted-only tenancy or billing behavior is introduced into OSS.

Validation

• 81 tests passed (358 assertions)
• production Vite build passed
• Composer audit: 0 advisories
• npm audit: 0 advisories
• OSS/platform runtime ownership check passed
• git diff --check passed