Release v0.2.40

Production hardening + Memcached + federated WebSocket rooms.

Highlights
- Production hardening pass on the Redis backend surface — closed 3
  critical (FD-reuse race in WSRouter, HMAC-signed L1 invalidations,
  rediss:// TLS) + 10 medium gaps. Default behaviour preserved across
  all 13 fixes.
- Memcached backend for Store + Counter (Store::BACKEND_MEMCACHED,
  Counter::BACKEND_MEMCACHED) with ZEALPHP_MEMCACHED_SERVERS env var
  + array config; phpredis + predis driver validated for SUBSCRIBE
  under HOOK_ALL.
- Federated WebSocket Rooms (P1.1 of v0.3.0 roadmap, landed early) —
  WSRouter::room(name): Room with first-class join/leave/push/onMessage/
  onPresence + cluster-wide membership via shared Store table + one
  PSUBSCRIBE pattern subscriber per worker.
- Three-backend Store facade — Store::BACKEND_TABLE / BACKEND_REDIS /
  BACKEND_TIERED, plus Cache::getOrCompute read-through with null
  sentinel.
- v0.3.0 early helpers — App::parallel / parallelLimit, App::onSignal,
  App::stats, HTTP::get/post/put/delete, App::addProcess for sidecars.
- Real end-to-end async integration tests for pub/sub + streams
  delivery (RedisPubSubFederationTest) + redis-pubsub coverage pass.
- Fixed route/demo_rooms.php deferring WSRouter::init to onWorkerStart
  (would crash production deploys with ZEALPHP_STORE_BACKEND=redis).

CI: every required check green, codecov/patch passed at 79.03%.