feat(iios): tenant-scoped /v1/dlq REST + chaos endpoint + smoke (P9 slice 5)

GET /v1/dlq lists the caller tenant's dead-letters; POST /v1/dlq/:id/replay
fences by assertOwns (KG-02) + audits each replay. Dev-only POST
/v1/dev/chaos/poison + ChaosConsumer (fails first delivery, succeeds on
replay) drive smoke-dlq.mjs: poison → QUARANTINED → cross-tenant denied →
owner replay → RESOLVED. Adds dev.chaos.v1 contract event.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packages/iios-contracts/src/events.ts

@@ -52,6 +52,7 @@ export const IIOS_EVENTS = {
   meetingSummarized: 'com.insignia.iios.calendar.meeting.summarized.v1',
   notificationQueued: 'com.insignia.iios.notification.queued.v1',
   deliveryAttempted: 'com.insignia.iios.delivery.attempted.v1',
+  devChaos: 'com.insignia.iios.dev.chaos.v1',
 } as const;
 
 export type IiosEventType = (typeof IIOS_EVENTS)[keyof typeof IIOS_EVENTS];