feat(notify): HMAC-signed outgoing webhooks with per-tier secrets and test sender

Outgoing notifications were bare POSTs with no auth and no way to verify
they came from Tinyforge. They also went out from one global URL only,
even though stages had a notification_url field, and static-site sync
emitted no events at all.

Schema: add notification_url + notification_secret (lazy-generated) to
settings, projects, stages and static_sites. Migrations are additive.

Notifier: SendSigned computes HMAC-SHA256 over the exact body bytes and
sends X-Hub-Signature-256 (GitHub-compatible — receivers built for
GitHub/Gitea/Forgejo verify out of the box). Aux headers
X-Tinyforge-Event/Delivery/Timestamp/Tier are advisory and not signed.
Empty secret => unsigned send for back-compat.

Resolution: deploys fall through stage > project > settings, sites fall
through site > settings. The secret travels with the URL that sourced
it, so any tier can sign even when its parents are unsigned. Site sync
events now actually emit (site_sync_success / site_sync_failure).

API: 12 new endpoints — {GET secret, POST regenerate, POST disable,
POST test} for each of the 4 tiers. SendSyncForTest returns
status_code/latency_ms/signature_sent/delivery_id/response_snippet so
the UI surfaces receiver feedback inline.

UI: shared OutgoingWebhookPanel.svelte fits the existing card aesthetic.
Signing-state pill, secret reveal-on-demand, regenerate/disable behind
ConfirmDialog modals (not inline strips — too easy to misclick), send-
test result card with colour-coded status. Wired into Settings →
Integrations, project edit form, per-stage edit, and per-site detail.
EN + RU i18n.

Tests: round-trip (sender signs, receiver verifies), tampered-body and
wrong-secret rejection, unsigned-send omits header, send-test surfaces
4xx, concurrent fan-out via Drain. Resolver precedence locked for both
deploy and site paths.

Docs: docs/webhooks.md with header reference, verifier snippets in
Node/Python/Go, and a recipe for the service-to-notification-bridge
generic webhook provider.

internal/store/static_sites.go

@@ -13,7 +13,9 @@ import (
 const staticSiteCols = `id, name, provider, gitea_url, repo_owner, repo_name, branch, folder_path,
 	access_token, domain, mode, render_markdown, sync_trigger, tag_pattern,
 	container_id, proxy_route_id, status, last_sync_at, last_commit_sha, error,
-	storage_enabled, storage_limit_mb, webhook_secret, created_at, updated_at`
+	storage_enabled, storage_limit_mb, webhook_secret,
+	notification_url, notification_secret,
+	created_at, updated_at`
 
 // CreateStaticSite inserts a new static site and returns it. A webhook secret
 // is generated automatically if one is not already set on the input.
@@ -29,13 +31,15 @@ func (s *Store) CreateStaticSite(site StaticSite) (StaticSite, error) {
 
 	_, err := s.db.Exec(
 		`INSERT INTO static_sites (`+staticSiteCols+`)
-		 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+		 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
 		site.ID, site.Name, site.Provider, site.GiteaURL, site.RepoOwner, site.RepoName,
 		site.Branch, site.FolderPath, site.AccessToken, site.Domain, site.Mode,
 		BoolToInt(site.RenderMarkdown), site.SyncTrigger, site.TagPattern,
 		site.ContainerID, site.ProxyRouteID, site.Status, site.LastSyncAt,
 		site.LastCommitSHA, site.Error, BoolToInt(site.StorageEnabled), site.StorageLimitMB,
-		site.WebhookSecret, site.CreatedAt, site.UpdatedAt,
+		site.WebhookSecret,
+		site.NotificationURL, site.NotificationSecret,
+		site.CreatedAt, site.UpdatedAt,
 	)
 	if err != nil {
 		return StaticSite{}, fmt.Errorf("insert static site: %w", err)
@@ -103,18 +107,21 @@ func (s *Store) GetStaticSitesByRepo(giteaURL, owner, name string) ([]StaticSite
 }
 
 // UpdateStaticSite updates an existing static site's configuration fields.
+// notification_secret is intentionally not updated here — use the dedicated
+// SetStaticSiteNotificationSecret rotation helper.
 func (s *Store) UpdateStaticSite(site StaticSite) error {
 	site.UpdatedAt = Now()
 	result, err := s.db.Exec(
 		`UPDATE static_sites SET name=?, provider=?, gitea_url=?, repo_owner=?, repo_name=?, branch=?,
 		 folder_path=?, access_token=?, domain=?, mode=?, render_markdown=?,
-		 sync_trigger=?, tag_pattern=?, storage_enabled=?, storage_limit_mb=?, updated_at=?
+		 sync_trigger=?, tag_pattern=?, storage_enabled=?, storage_limit_mb=?,
+		 notification_url=?, updated_at=?
 		 WHERE id=?`,
 		site.Name, site.Provider, site.GiteaURL, site.RepoOwner, site.RepoName, site.Branch,
 		site.FolderPath, site.AccessToken, site.Domain, site.Mode,
 		BoolToInt(site.RenderMarkdown), site.SyncTrigger, site.TagPattern,
 		BoolToInt(site.StorageEnabled), site.StorageLimitMB,
-		site.UpdatedAt, site.ID,
+		site.NotificationURL, site.UpdatedAt, site.ID,
 	)
 	if err != nil {
 		return fmt.Errorf("update static site: %w", err)
@@ -228,7 +235,9 @@ func scanStaticSiteRow(row *sql.Row) (StaticSite, error) {
 		&renderMarkdown, &site.SyncTrigger, &site.TagPattern,
 		&site.ContainerID, &site.ProxyRouteID, &site.Status, &site.LastSyncAt,
 		&site.LastCommitSHA, &site.Error, &storageEnabled, &site.StorageLimitMB,
-		&site.WebhookSecret, &site.CreatedAt, &site.UpdatedAt,
+		&site.WebhookSecret,
+		&site.NotificationURL, &site.NotificationSecret,
+		&site.CreatedAt, &site.UpdatedAt,
 	)
 	if err != nil {
 		return StaticSite{}, err
@@ -248,7 +257,9 @@ func scanStaticSiteRows(rows *sql.Rows) (StaticSite, error) {
 		&renderMarkdown, &site.SyncTrigger, &site.TagPattern,
 		&site.ContainerID, &site.ProxyRouteID, &site.Status, &site.LastSyncAt,
 		&site.LastCommitSHA, &site.Error, &storageEnabled, &site.StorageLimitMB,
-		&site.WebhookSecret, &site.CreatedAt, &site.UpdatedAt,
+		&site.WebhookSecret,
+		&site.NotificationURL, &site.NotificationSecret,
+		&site.CreatedAt, &site.UpdatedAt,
 	)
 	if err != nil {
 		return StaticSite{}, fmt.Errorf("scan static site: %w", err)
@@ -258,6 +269,58 @@ func scanStaticSiteRows(rows *sql.Rows) (StaticSite, error) {
 	return site, nil
 }
 
+// SetStaticSiteNotificationSecret rotates the static site's outgoing-webhook
+// signing secret. Empty string disables HMAC signing for this site
+// (notifications still send unsigned, falling through to global resolution).
+func (s *Store) SetStaticSiteNotificationSecret(id, secret string) error {
+	result, err := s.db.Exec(
+		`UPDATE static_sites SET notification_secret=?, updated_at=? WHERE id=?`,
+		secret, Now(), id,
+	)
+	if err != nil {
+		return fmt.Errorf("set static site notification secret: %w", err)
+	}
+	n, _ := result.RowsAffected()
+	if n == 0 {
+		return fmt.Errorf("static site %s: %w", id, ErrNotFound)
+	}
+	return nil
+}
+
+// EnsureStaticSiteNotificationSecret returns the static site's outgoing-webhook
+// signing secret, generating one lazily if missing.
+func (s *Store) EnsureStaticSiteNotificationSecret(id string) (string, error) {
+	site, err := s.GetStaticSiteByID(id)
+	if err != nil {
+		return "", err
+	}
+	if site.NotificationSecret != "" {
+		return site.NotificationSecret, nil
+	}
+	secret := generateWebhookSecret()
+	if err := s.SetStaticSiteNotificationSecret(id, secret); err != nil {
+		return "", err
+	}
+	return secret, nil
+}
+
+// EnsureSettingsNotificationSecret returns the global outgoing-webhook signing
+// secret, generating one lazily if missing.
+func (s *Store) EnsureSettingsNotificationSecret() (string, error) {
+	st, err := s.GetSettings()
+	if err != nil {
+		return "", err
+	}
+	if st.NotificationSecret != "" {
+		return st.NotificationSecret, nil
+	}
+	secret := generateWebhookSecret()
+	if err := s.SetSettingsNotificationSecret(secret); err != nil {
+		return "", err
+	}
+	return secret, nil
+}
+
 // GetStaticSiteByWebhookSecret looks up a static site by its webhook secret.
 // Returns ErrNotFound if no site has this secret (including empty).
 func (s *Store) GetStaticSiteByWebhookSecret(secret string) (StaticSite, error) {