feat: global API rate limiting + webhook dispatcher wired to key events

Rate limiting (middleware-level):
- 120 requests/minute per IP for all /api/* routes
- Returns 429 with retry-after header when exceeded
- In-memory store (per-container, sufficient for single-instance)

Webhook dispatcher wired to events:
- license.created → fires when a new license is issued
- ticket.created → fires when a support ticket is created
- instance.provisioned → fires when a tenant instance goes live
- Each event includes relevant payload (key, product, URL, etc.)
- Fire-and-forget (doesn't block the response)
- HMAC-SHA256 signed (existing webhook.ts implementation)

Also:
- Ticket creation now sends email notification (sendTicketCreatedEmail)

src/app/api/aos/licenses/route.ts

@@ -316,6 +316,20 @@ export async function POST(req: Request) {
       }).catch(() => {}) // fire-and-forget, don't block response
     }
 
+    // Dispatch webhook event
+    const { dispatchWebhook } = await import('@/lib/webhook')
+    dispatchWebhook('license.created', {
+      licenseId: license.id,
+      key,
+      product,
+      plan,
+      companyId: license.companyId,
+      companyName: company.name,
+      environment,
+      billingCycle,
+      netPriceCents: pricing.netPriceCents,
+    }).catch(() => {})
+
     return NextResponse.json({ license, pricing: pricing.breakdown }, { status: 201 })
   } catch (err) {
     const msg = err instanceof Error ? err.message : 'internal server error'