H3: TuvensInternalApiMiddleware + POST /api/tuvens/events + promo-field PUT #19

Part of the Tuvens integration workstream (brief: #16, items 2 and 5). Follows #17/H2. API-side counterparts: tuvens-api#121 series.

• TuvensInternalApiMiddleware: HMAC-SHA256 over timestamp + "." + body with the shared secret (X-Tuvens-Timestamp + X-Tuvens-Signature), timestamp window ±5 min, constant-time compare; resolves X-On-Behalf-Of: {tuvens_user_id} → local user via users.external_user_id → auth context.
• POST /api/tuvens/events: create draft event with attributes.tuvens_event_id (ruling 3 — attributes JSON column confirmed on events; the old code's metadata key is superseded), auto-register a per-event outgoing webhook pointing at tuvens-api POST /api/webhooks/ticketing/hi-events, respond {event_id, event_url, widget_embed_url, webhook_secret}.
• Promo-field PUT /api/events/{id} through the same middleware honoring X-Idempotency-Key. Field ownership is disjoint (Tuvens integration workstream: architecture brief and task series (H1–H5) #16 item 5): tuvens owns title/description/dates/timezone/venue; hi.events owns products/prices/currency/capacity/sale status.

Dependency: pin exact endpoint/payload/signature details to tuvens-api docs/integrations/hi-events-contract.md (their first deliverable; does not exist yet as of filing — if still missing at H3 start, comment on #16).