feat(ops): alarm on a TLS leaf SPKI change for pinned native clients

The native client SPKI-pins the server's TLS leaf certificate. When the
leaf auto-renews (GTS re-issues it roughly every 90 days) the leaf keypair
— and so the SPKI pin — changes, and a client shipped only the old pin
refuses to connect on the next renewal: a silent outage. Nothing
server-side signalled that a client pins the served leaf.

Add a pg-boss monitor that probes the served leaf every 6 hours, computes
its iOS SPKI pin (base64(sha256(DER subjectPublicKeyInfo)) via a raw TLS
socket + X509Certificate), and compares it against the operator's
known-good set in TLS_LEAF_SPKI_PINS (comma-separated for the dual-pin
renewal window). On a served pin outside the set it fails loud: a
tls.pin.leaf_changed wide-event annotation, a system.tls.pin_changed audit
row, and a high-priority SYSTEM_ALERT fanned out to admins through the
existing dispatcher idiom. Transient TLS/network failures annotate
tls.pin.probe_failed and never alarm.

The baseline is an env var, not a persisted last-seen row — a self-learning
baseline would silently adopt the first rotation and suppress the alarm the
pinned client needs; an unset baseline logs the served pin and warns rather
than auto-adopting. The runbook documents extraction, the re-pin + dual-pin
procedure (≥11 days before expiry, ship to TestFlight), and the assumption
that the probed host is the host the client connects to.

Wires the queue into the worker (allQueues + cron + worker), adds the
optional env to the manifest, compose whitelist, and .env example, and
covers the SPKI computation + change detection with a fixture-cert unit
test plus a queue-registration guard.

(cherry picked from commit cdb88cd77b88aec71ad2f21caf2b15c185dfc01e)

docker-compose.yml

@@ -65,6 +65,13 @@ services:
       # container (the `environment:` block is a whitelist).
       WHOOP_WEBHOOK_SECRET: "${WHOOP_WEBHOOK_SECRET:-}"
       WHOOP_REDIRECT_URI: "${WHOOP_REDIRECT_URI:-}"
+      # TLS leaf SPKI-change alarm baseline (optional). The native client
+      # pins the served TLS leaf; this is the known-good pin set the monitor
+      # alarms against on a rotation. Comma-separated for the dual-pin
+      # renewal window. Listed here so an operator value in .env reaches the
+      # container (the `environment:` block is a whitelist). See
+      # docs/ops/tls-cert-pin.md.
+      TLS_LEAF_SPKI_PINS: "${TLS_LEAF_SPKI_PINS:-}"
     depends_on:
       db:
         condition: service_healthy