Harden external input handling for webhooks, drops, and OAuth registration

Hardened how Hive handles untrusted external input across the surfaces that receive it: domain webhooks, drop normalization, and the OAuth dynamic client registration endpoint. Arbitrary string-to-atom conversion (String.to_existing_atom/1) was replaced with explicit key whitelists, so unexpected keys in payloads are ignored instead of being mapped into the atom table. OAuth registration now safely normalizes malformed metadata (non-map values fall back to %{}) instead of crashing, and the OAuth registration rate-limit store prunes stale buckets so it cannot grow unbounded over time. The result is a more resilient ingestion path for incoming webhooks and OAuth clients.