Improve API real-time and webhook evidence gates

[danyili2632]

Summary

• expands API surface inventory beyond REST/GraphQL/gRPC to include WebSocket, SSE, webhook/callback, and async job/result flows
• adds evidence gates for WSS, Origin/CSRF/CSWSH, session lifecycle, per-message authorization, payload limits, replay protection, rate limits, and monitoring
• adds webhook/callback checks for raw-body signature verification, timestamp freshness, nonce/event replay cache, idempotency, event allowlists, secret rotation, and safe failure handling
• models async job/result lifecycles from create/status/worker/callback/result URL with owner and tenant authorization checks
• extends output API style values and adds a real-time/webhook/async evidence table

Validation

• git diff --check
• rg -n "Real-Time|WebSocket|SSE|Webhook|Callback|Async Job|raw-body|Origin allowlist|CSWSH|per-message|idempotency|result URL|WebSocket Security Cheat Sheet" skills/appsec/api-security/SKILL.md
• verified Markdown fence count remains even: 8

Closes #1443

Bounty target: Improver Moderate if accepted.
Preferred payout: Base USDC 0x6CBF4b5cb88b8C2B7af776Bc2B073163B5d3C08A