fix: per-asset alert index, webhook probe retries, SSRF check before probe, atomic recipient SADD

[Big-JoshCode]

Summary

• alerts.js — evaluateForAssetInner now looks up alerts via a per-asset Redis set index (alerts:asset:<ASSET>) instead of ZREVRANGE-ing and fetching every alert in the system on every price tick. The index is kept in sync by create()/remove(); a backfillAssetIndex() helper is exported for a one-time backfill against existing deployments (alerts created before this change won't be in the index until backfilled or re-created).
• webhook.js — probeReachability now retries a transient network failure (ECONNRESET/ETIMEDOUT/ECONNABORTED/ECONNREFUSED/ENETUNREACH/EHOSTUNREACH/EAI_AGAIN) up to WEBHOOK_PROBE_RETRY_ATTEMPTS (default 2) times per method before giving up. HTTP error responses (4xx/5xx) are never retried — they're a real answer from the target, not a transient failure.
• routes/webhooks.js — POST /webhooks now runs the same assertPublicTarget SSRF guard already used at delivery/test time before calling probeReachability. Previously the probe made an outbound HTTP request to a completely unvalidated caller-supplied URL — webhookRepo.create()'s own URL/SSRF validation only ran after the probe had already fired, making the probe itself usable as an SSRF oracle against internal/private targets.
• airdrops.js — addRecipients() now queues its per-address SADD calls on a single MULTI/EXEC instead of Promise.all-ing N independent commands. The independent calls could interleave with another concurrent addRecipients() call on the same airdrop, so two overlapping requests for the same address could each observe "newly added" and both append it to the recipients list.

Closes #310,
Closes #311,
Closes #313,
Closes #312.

Test plan

• evaluateForAsset('XLM', price) only touches alerts:asset:XLM members, not the full alerts:ids set
• probeReachability against a target that resets the connection on the first attempt but succeeds on retry
• POST /webhooks with a URL resolving to a private/internal address is rejected before any outbound probe request is made
• Two concurrent POST /airdrops/:id/recipients calls with an overlapping address set never both report the address as newly added

[drips-wave]

@Big-JoshCode Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits