feat(outbox): transactional outbox + relay (AddCaliberOutbox, RelayHost) (#36)

[williamdewitt]

Summary

Transactional-outbox mode — the heart of M2 — behind the documented one-liner:

builder.Services.AddCaliberWebhooks(o => o.UseEntityFramework<AppDbContext>());
// in AppDbContext:
protected override void OnModelCreating(ModelBuilder b) => b.AddCaliberOutbox();

await _webhooks.PublishAsync("order.shipped", new { orderId, trackingNo });
await db.SaveChangesAsync();   // ONE transaction: business data + outbox row

• AddCaliberOutbox(ModelBuilder) — maps the thin caliber_outbox table onto the caller's model (they migrate it via their normal dotnet ef workflow). created_at is stored as UTC ticks so the relay's ORDER BY translates on SQLite (which cannot ORDER BY a DateTimeOffset) and Postgres alike.
• OutboxPublisher<TContext> (scoped IWebhookPublisher) — PublishAsync stages a row into the caller's scoped DbContext and returns; no SaveChanges. The caller's SaveChangesAsync commits it atomically with their business data (no-magic-SaveChanges, design feat(config): AddCaliberWebhooks options + validation #6).
• RelayProcessor + RelayHost<TContext> (BackgroundService) — drains committed outbox rows oldest-first, fans out to matching endpoints (as-of-relay-time), inserts via the existing IMessageStore.AddAsync (idempotent on (event_id, endpoint_id)), then deletes the drained rows. Crash-safety rests on that idempotency: a crash between insert and delete re-fans-out and no-ops on retry. Mirrors DispatcherHost's PeriodicTimer/TimeProvider drain-while-full + transient-survival idiom.
• UseEntityFramework<TContext>() — wires the EF stores against TContext's own database (provider + connection read from the caller's context; SQLite in v1, Postgres lands with feat(storage): durable Postgres store + shipped migrations (FOR UPDATE SKIP LOCKED) #38), the scoped outbox publisher, the relay, and a shared-schema initializer that CREATE TABLEs Caliber's messages/endpoints into the caller DB when absent (idempotent; production Postgres ships reviewed migrations in feat(storage): durable Postgres store + shipped migrations (FOR UPDATE SKIP LOCKED) #38).
• Core — IngestionManager publisher registration → TryAddSingleton, so a provider's StoreConfigurator can supply an outbox-mode publisher that wins.

Both standalone (direct PublishAsync → messages) and outbox (stage → relay) modes work behind the same IWebhookPublisher; the guarantee tier surfaces at the store-config line, never a silent downgrade.

Design note (reviewers)

The design doc floated a single-transaction relay (insert messages + delete outbox in one tx). This PR implements the issue-#36 acceptance criteria literally — fan-out via the existing IMessageStore + idempotent insert — which gives the same crash-safety through idempotency rather than a shared transaction, and lets messages reuse the exact store the dispatcher already claims from. transactional-outbox.md is reconciled to match.

Closes

Closes #36. Part of the #8 M2 epic. (SQLite tier #37 already merged via #59/#60; Postgres + migrations is #38.)

Test plan

• dotnet build -c Release — 0 warnings (net8 + net10)
• dotnet test -c Release — 203/203 (+11: staging-doesn't-commit, fan-out single/multi, idempotent re-drain, unmatched drains, oldest-first, empty, null guards, DI wiring)
• CI: build · test · pack · mutation diff-gate

🤖 Generated with Claude Code