Design: put the event outbox behind a framework transport protocol instead of inside background_tasks #502

Tier 2: structural (needs a design note first)

Problem

background_tasks is about 6k lines across 37 files and now owns four separate concerns:

• Celery tasks and retries
• task routing and worker tuning (background_tasks: no way for a module to route its tasks to a queue (task_routes hook) #447-background_tasks: every worker imports every module's tasks.py — no per-worker module/queue subset for heavy dependencies #450)
• the cross-process invalidation transport
• the durable event outbox (core: opt-in durable event delivery (outbox) — handler failures are only logged today #459): nine outbox_*.py files plus an admin page

The outbox is a delivery guarantee for domain events. That is a framework concern, but today it only exists when Celery is installed. InvalidationBus already shows the right pattern: a framework protocol with a transport plugged in from background_tasks.

There is also undeclared coupling. file_storage lazily imports background_tasks (checksum.py:50, tasks.py:39,51,143-144) without declaring it in depends_on.

Proposal

• Define an EventTransport (or OutboxStore / OutboxDispatcher) protocol in core, modelled on InvalidationBus.
• Keep the outbox tables and claim/fence logic wherever the protocol is implemented. Keep the Celery-specific dispatcher in background_tasks.
• Declare background_tasks as an optional dependency of file_storage, or route through the protocol.