feat(events): processor handles SYSTEM_ARM_REQUEST over MQTT

Adds _handle_arm_request and a dedicated bus.subscribe on
Topics.SYSTEM_ARM_REQUEST. Payload {mode, pin, triggered_by} is
dispatched to ArmStateFSM.transition, which verifies the PIN via
alerts.pin.verify_pin and performs the state change.

This is the missing link for web /system/api/arm to actually move
the system into an armed state. Part of issue #2.

tests/unit/test_events.py

@@ -511,3 +511,54 @@ class TestEventsPublishedBroadcast:
         )
 
         assert not any(t == Topics.EVENTS_PUBLISHED for t, _ in bus.published)
+
+
+# ---------------------------------------------------------------------------
+# Arm Request Dispatch
+# ---------------------------------------------------------------------------
+
+class TestArmRequestDispatch:
+    """SYSTEM_ARM_REQUEST messages must reach ArmStateFSM.transition."""
+
+    def test_arm_request_calls_fsm_transition(self, test_db):
+        from vigilar.events.processor import EventProcessor
+
+        processor = EventProcessor.__new__(EventProcessor)
+
+        calls = []
+
+        class FakeFSM:
+            state = ArmState.DISARMED
+
+            def transition(self, new_state, pin="", triggered_by="system"):
+                calls.append((new_state, pin, triggered_by))
+                return True
+
+        processor._handle_arm_request(
+            payload={"mode": "ARMED_AWAY", "pin": "1234", "triggered_by": "web"},
+            fsm=FakeFSM(),
+        )
+
+        assert len(calls) == 1
+        new_state, pin, triggered_by = calls[0]
+        assert new_state == ArmState.ARMED_AWAY
+        assert pin == "1234"
+        assert triggered_by == "web"
+
+    def test_arm_request_ignores_bad_mode(self, test_db):
+        from vigilar.events.processor import EventProcessor
+
+        processor = EventProcessor.__new__(EventProcessor)
+        calls = []
+
+        class FakeFSM:
+            def transition(self, *a, **kw):
+                calls.append((a, kw))
+                return True
+
+        processor._handle_arm_request(
+            payload={"mode": "NONSENSE", "pin": "1234"},
+            fsm=FakeFSM(),
+        )
+
+        assert calls == []