[FEAT] Implement outbound workspace webhooks (CRUD, signed delivery, logs)

[martian56]

Type / Priority

Feature / High

Summary

Outbound webhooks are scaffolded but never delivered and have no management UI.

Current state (evidence)

• queue.PublishWebhook (api/internal/queue/queue.go:92) is never called; the consumer uses NoopWebhookDeliverer (cmd/api/main.go:120, queue/consumer.go:173-174) which only logs.
• model/webhook.go has no event-type columns; no webhook_logs table; no webhook CRUD routes (only inbound /webhooks/github, router.go:494); the settings tab is a placeholder ("Webhooks settings will be available when the API is connected", SettingsPage.tsx:3866-3874). No webhookService.

Proposed scope

Add event-type columns; fire PublishWebhook from mutating services; a real HTTP deliverer with HMAC-SHA256 signing + retries; a webhook_logs table + delivery history; CRUD handlers/routes under /api/workspaces/:slug/webhooks/; a webhookService and management UI.

[cavidelizade]

I'd like to take this one - wiring the outbound webhooks end to end (CRUD, HMAC-signed delivery with retries + SSRF guard, and delivery logs). Can I take it? @martian56

[cavidelizade]

Opened #306 for this one, @martian56 — outbound webhooks with signed delivery, retries, delivery logs, and a Settings UI. Would appreciate a look when you get a chance.