Hardened the background worker's Realtime outbox-job listener so a dropped or errored Realtime connection can no longer leak server-side subscriptions. The listener now releases the affected channel and reconnects with bounded backoff, and the underlying database connection pool is protected so a single slow query or abandoned transaction can't starve it. This eliminates a failure mode where webhook ingestion could intermittently time out under sustained reconnect churn.
Reliability & data
Message delivery is unaffected by Realtime hiccups: job pickup always falls back to the worker's polling loop, so the Realtime path is now purely a latency optimization rather than a dependency.
No customer data is exposed or changed by this release; the database guardrails apply only to connection lifetimes, not to stored records.
Verification
pnpm --filter worker test (self-healing resubscribe, backoff/reset, TIMED_OUT/CLOSED handling, no-resubscribe-after-stop)
