Fix webhook dedup TTL, WS auth callback, and event validation

[m1s0g1]

Summary

• Extended webhook dedup key TTL from 24h to 90 days to prevent old events from being re-dispatched
• Refactored WebSocket authentication callback to properly handle async API key validation
• Added IP address detection using x-forwarded-for header for accurate client IP logging behind proxies
• Added required field validation in eventStore upsertAirdrop to prevent null values in stored records

Test plan

• Webhook duplicate dispatch logic works with extended TTL
• WebSocket authentication properly rejects invalid keys
• Verify client IP is logged correctly behind proxies using x-forwarded-for
• Event validation prevents incomplete airdrop_created events from being stored

Closes #405
Closes #404
Closes #403
Closes #406

[drips-wave]

@m1s0g1 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits