[llbbl]

Summary

• Add authenticated webhook CRUD and Vue management UI with one-time signing secret display and redelivery history.
• Fan out membership-scoped message, reaction, and channel events with payload bounds and SSRF protections.
• Add signed retry delivery worker with leases, exponential backoff, drop handling, documentation, and integration coverage.

Changes

Webhook delivery

• app/Models/WebhookModel.php: Persist owner-scoped webhooks and delivery history, enqueue matching events, and support redelivery.
• app/Services/WebhookDeliveryService.php: Deliver HMAC-signed payloads with bounded retries and lease handling.
• app/Controllers/Api/V1/WebhooksController.php: Expose authenticated CRUD, history, and redelivery endpoints with validation and rate limits.
• app/Services/WebhookUrlValidator.php: Restrict destinations to safe HTTPS URLs and permitted local HTTP integration targets.

UI and documentation

• src/vue/WebhookPanel.vue: Add webhook creation, activation, history, redelivery, and deletion controls.
• docs/webhooks.md: Document event schemas, signature verification, retry policy, and operating guidance.
• docs/openapi.yaml: Describe the webhook API contract.

Tests

• tests/Tests/Integration/WebhookIntegrationTest.php: Cover API ownership, event fanout, local HTTP signatures, retries, drops, payload limits, and rate limits.
• e2e/chat-vue.spec.ts: Exercise webhook management through the Vue UI.

Test plan

• composer test:all (244 tests, 1049 assertions)
• Focused webhook suite (7 tests, 90 assertions)
• composer test:integration:websocket (7 tests, 61 assertions)
• composer analyse
• composer cs-check
• pnpm check
• pnpm build
• pnpm api:lint (30 operations)
• pnpm e2e (7 passed)
• composer audit
• git diff --check
• Mutation testing was not run because it is manual-only.

Closes #133