feat(webhook): per-project and per-site webhook URLs

Replace the single global webhook secret with entity-scoped secrets stored
on each project and static site. Webhook-driven project autocreate is
removed — projects must exist before their URL can trigger deploys.

Also wires static-site webhooks (sync_trigger=push|tag), turning the
previously inert "push" trigger into a functional one: POST the site's
webhook URL from a Git provider and Tinyforge re-syncs on matching refs.

- Adds webhook_secret columns + unique indexes to projects and static_sites
- Per-entity GET/regenerate endpoints under /api/projects/{id}/webhook
  and /api/sites/{id}/webhook (admin-only)
- Removes /api/settings/webhook-url and the global webhook panel
- Reusable WebhookPanel Svelte component on both detail pages, i18n in en/ru
- Tests for matcher (siteRefMatches, ParseImageRef) and handler (project
  match/mismatch/404 and site push/manual/branch-skip)

cmd/server/main.go

@@ -148,16 +148,10 @@ func main() {
 
 	dep := deployer.New(dockerClient, proxyProvider, db, healthChecker, notifier, eventBus, encKey)
 
-	// Initialize webhook handler.
-	webhookHandler := webhook.NewHandler(db, dep, dockerClient)
-
-	// Ensure webhook secret exists.
-	_, err = webhook.EnsureWebhookSecret(db)
-	if err != nil {
-		slog.Error("ensure webhook secret", "error", err)
-		os.Exit(1)
-	}
-	slog.Info("webhook secret configured (use /api/settings/webhook-url to retrieve)")
+	// Initialize webhook handler. Per-project and per-site secrets are stored
+	// on their respective rows; the static-site triggerer is wired in below
+	// once the site manager has been constructed.
+	webhookHandler := webhook.NewHandler(db, dep, nil)
 
 	// Initialize registry poller.
 	poller := registry.NewPoller(db, dep, encKey)
@@ -284,6 +278,7 @@ func main() {
 
 	// Initialize static site manager and health checker.
 	staticSiteMgr := staticsite.NewManager(db, dockerClient, proxyProvider, eventBus, encKey)
+	webhookHandler.SetSiteSyncTriggerer(staticSiteMgr)
 	staticSiteHealth := staticsite.NewHealthChecker(db, dockerClient, staticSiteMgr)
 	if err := staticSiteHealth.Start("2m"); err != nil {
 		slog.Warn("failed to start static site health checker", "error", err)