SRS on_publish webhook — creates or resumes a stream session artifact.

This endpoint is called by SRS from inside the Docker network. It is not protected by the standard user-auth middleware. The stream key in the payload serves as the credential.

SRS expects a {"code": 0} response to allow the stream through. Any non-zero code or 4xx/5xx causes SRS to reject the publisher.