Function useThrottleEvents

Subscribe to validated postMessage events from a Throttle iframe.

Validation:

• event.origin === expectedOrigin (strict string match)
• event.source === iframeRef.current.contentWindow (defends against other iframes on the same origin spoofing events)
• event.data.source === 'throttle' && event.data.version === 1
• event.data.type starts with 'throttle.'

Anything failing validation is silently dropped — the parent page may receive postMessages from analytics SDKs, browser extensions, other iframes, etc. We must never throw on those.