feat(webhook): per-project and per-site webhook URLs

Replace the single global webhook secret with entity-scoped secrets stored
on each project and static site. Webhook-driven project autocreate is
removed — projects must exist before their URL can trigger deploys.

Also wires static-site webhooks (sync_trigger=push|tag), turning the
previously inert "push" trigger into a functional one: POST the site's
webhook URL from a Git provider and Tinyforge re-syncs on matching refs.

- Adds webhook_secret columns + unique indexes to projects and static_sites
- Per-entity GET/regenerate endpoints under /api/projects/{id}/webhook
  and /api/sites/{id}/webhook (admin-only)
- Removes /api/settings/webhook-url and the global webhook panel
- Reusable WebhookPanel Svelte component on both detail pages, i18n in en/ru
- Tests for matcher (siteRefMatches, ParseImageRef) and handler (project
  match/mismatch/404 and site push/manual/branch-skip)

internal/api/router.go

@@ -231,6 +231,10 @@ func (s *Server) Router() chi.Router {
 					r.Put("/", s.updateProject)
 					r.Delete("/", s.deleteProject)
 
+					// Per-project webhook URL management.
+					r.Get("/webhook", s.getProjectWebhook)
+					r.Post("/webhook/regenerate", s.regenerateProjectWebhook)
+
 					// Stage endpoints.
 					r.Post("/stages", s.createStage)
 					r.Put("/stages/{stage}", s.updateStage)
@@ -293,6 +297,8 @@ func (s *Server) Router() chi.Router {
 					r.Post("/deploy", s.deployStaticSite)
 					r.Post("/stop", s.stopStaticSite)
 					r.Post("/start", s.startStaticSite)
+					r.Get("/webhook", s.getStaticSiteWebhook)
+					r.Post("/webhook/regenerate", s.regenerateStaticSiteWebhook)
 					r.Post("/secrets", s.createStaticSiteSecret)
 					r.Put("/secrets/{sid}", s.updateStaticSiteSecret)
 					r.Delete("/secrets/{sid}", s.deleteStaticSiteSecret)
@@ -372,8 +378,6 @@ func (s *Server) Router() chi.Router {
 
 				// Settings endpoints.
 				r.Put("/settings", s.updateSettings)
-				r.Get("/settings/webhook-url", s.getWebhookURL)
-				r.Post("/settings/webhook-url/regenerate", s.regenerateWebhookSecret)
 
 				// Docker management.
 				r.Post("/docker/prune-images", s.pruneImages)