feat(notify): HMAC-signed outgoing webhooks with per-tier secrets and test sender

Outgoing notifications were bare POSTs with no auth and no way to verify
they came from Tinyforge. They also went out from one global URL only,
even though stages had a notification_url field, and static-site sync
emitted no events at all.

Schema: add notification_url + notification_secret (lazy-generated) to
settings, projects, stages and static_sites. Migrations are additive.

Notifier: SendSigned computes HMAC-SHA256 over the exact body bytes and
sends X-Hub-Signature-256 (GitHub-compatible — receivers built for
GitHub/Gitea/Forgejo verify out of the box). Aux headers
X-Tinyforge-Event/Delivery/Timestamp/Tier are advisory and not signed.
Empty secret => unsigned send for back-compat.

Resolution: deploys fall through stage > project > settings, sites fall
through site > settings. The secret travels with the URL that sourced
it, so any tier can sign even when its parents are unsigned. Site sync
events now actually emit (site_sync_success / site_sync_failure).

API: 12 new endpoints — {GET secret, POST regenerate, POST disable,
POST test} for each of the 4 tiers. SendSyncForTest returns
status_code/latency_ms/signature_sent/delivery_id/response_snippet so
the UI surfaces receiver feedback inline.

UI: shared OutgoingWebhookPanel.svelte fits the existing card aesthetic.
Signing-state pill, secret reveal-on-demand, regenerate/disable behind
ConfirmDialog modals (not inline strips — too easy to misclick), send-
test result card with colour-coded status. Wired into Settings →
Integrations, project edit form, per-stage edit, and per-site detail.
EN + RU i18n.

Tests: round-trip (sender signs, receiver verifies), tampered-body and
wrong-secret rejection, unsigned-send omits header, send-test surfaces
4xx, concurrent fan-out via Drain. Resolver precedence locked for both
deploy and site paths.

Docs: docs/webhooks.md with header reference, verifier snippets in
Node/Python/Go, and a recipe for the service-to-notification-bridge
generic webhook provider.

web/src/routes/settings/integrations/+page.svelte

@@ -1,14 +1,23 @@
 <!--
   Settings › Integrations
 
-  Outward-facing hooks: where Tinyforge *sends* events (notification URL).
+  Outward-facing hooks: where Tinyforge *sends* events.
+    1. URL field (global / fallback) — saved via /api/settings.
+    2. Outgoing-webhook panel — secret rotate, disable signing, send test.
   Inbound webhooks are per-project / per-site and live on their respective
-  detail pages — this page no longer exposes a global "master" webhook.
+  detail pages — this page deliberately does not surface them.
 -->
 <script lang="ts">
-	import { getSettings, updateSettings } from '$lib/api';
+	import {
+		getSettings, updateSettings,
+		getSettingsNotificationSecret,
+		regenerateSettingsNotificationSecret,
+		disableSettingsNotificationSigning,
+		testSettingsNotification,
+	} from '$lib/api';
 	import FormField from '$lib/components/FormField.svelte';
 	import Skeleton from '$lib/components/Skeleton.svelte';
+	import OutgoingWebhookPanel from '$lib/components/OutgoingWebhookPanel.svelte';
 	import { toasts } from '$lib/stores/toast';
 	import { t } from '$lib/i18n';
 	import { IconLoader } from '$lib/components/icons';
@@ -17,6 +26,9 @@
 	let saving = $state(false);
 
 	let notificationUrl = $state('');
+	// Tracks the last persisted URL so the OutgoingWebhookPanel's hasUrl
+	// flag reflects what the backend actually has, not unsaved input.
+	let savedNotificationUrl = $state('');
 	let errors = $state<Record<string, string>>({});
 
 	function validateUrl(value: string): string {
@@ -29,6 +41,7 @@
 		try {
 			const settings = await getSettings();
 			notificationUrl = settings.notification_url ?? '';
+			savedNotificationUrl = notificationUrl;
 		} catch (err) {
 			toasts.error(err instanceof Error ? err.message : $t('settingsGeneral.loadFailed'));
 		} finally {
@@ -43,6 +56,7 @@
 		saving = true;
 		try {
 			await updateSettings({ notification_url: notificationUrl.trim() });
+			savedNotificationUrl = notificationUrl.trim();
 			toasts.success($t('settingsGeneral.saved'));
 		} catch (err) {
 			toasts.error(err instanceof Error ? err.message : $t('settingsGeneral.saveFailed'));
@@ -87,6 +101,17 @@
 			</div>
 		</div>
 
+		<!-- Outgoing: signing secret + send test -->
+		<OutgoingWebhookPanel
+			title={$t('outgoingWebhook.signingSecret')}
+			description={$t('settingsIntegrations.outgoingDesc')}
+			hasUrl={!!savedNotificationUrl}
+			fetchSecret={getSettingsNotificationSecret}
+			regenerateSecret={regenerateSettingsNotificationSecret}
+			disableSigning={disableSettingsNotificationSigning}
+			sendTest={testSettingsNotification}
+		/>
+
 		<!-- Inbound hooks now live per-entity. -->
 		<div class="rounded-xl border border-[var(--border-primary)] bg-[var(--surface-card)] p-6 shadow-[var(--shadow-sm)]">
 			<h2 class="mb-1 text-lg font-semibold text-[var(--text-primary)]">{$t('settingsIntegrations.incoming')}</h2>