feat(webhook): per-project and per-site webhook URLs

Replace the single global webhook secret with entity-scoped secrets stored
on each project and static site. Webhook-driven project autocreate is
removed — projects must exist before their URL can trigger deploys.

Also wires static-site webhooks (sync_trigger=push|tag), turning the
previously inert "push" trigger into a functional one: POST the site's
webhook URL from a Git provider and Tinyforge re-syncs on matching refs.

- Adds webhook_secret columns + unique indexes to projects and static_sites
- Per-entity GET/regenerate endpoints under /api/projects/{id}/webhook
  and /api/sites/{id}/webhook (admin-only)
- Removes /api/settings/webhook-url and the global webhook panel
- Reusable WebhookPanel Svelte component on both detail pages, i18n in en/ru
- Tests for matcher (siteRefMatches, ParseImageRef) and handler (project
  match/mismatch/404 and site push/manual/branch-skip)

web/src/lib/api.ts

@@ -319,12 +319,27 @@ export function updateSettings(data: Partial<Settings>): Promise<Settings> {
 	return put<Settings>('/api/settings', data);
 }
 
-export function getWebhookUrl(): Promise<{ webhook_url: string }> {
-	return get<{ webhook_url: string }>('/api/settings/webhook-url');
+// ── Webhooks ───────────────────────────────────────────────────────
+
+export interface WebhookUrlResponse {
+	webhook_url: string;
+	webhook_secret: string;
 }
 
-export function regenerateWebhookUrl(): Promise<{ webhook_url: string }> {
-	return post<{ webhook_url: string }>('/api/settings/webhook-url/regenerate');
+export function getProjectWebhook(projectId: string): Promise<WebhookUrlResponse> {
+	return get<WebhookUrlResponse>(`/api/projects/${projectId}/webhook`);
+}
+
+export function regenerateProjectWebhook(projectId: string): Promise<WebhookUrlResponse> {
+	return post<WebhookUrlResponse>(`/api/projects/${projectId}/webhook/regenerate`);
+}
+
+export function getStaticSiteWebhook(siteId: string): Promise<WebhookUrlResponse> {
+	return get<WebhookUrlResponse>(`/api/sites/${siteId}/webhook`);
+}
+
+export function regenerateStaticSiteWebhook(siteId: string): Promise<WebhookUrlResponse> {
+	return post<WebhookUrlResponse>(`/api/sites/${siteId}/webhook/regenerate`);
 }
 
 // ── Proxy Routes ───────────────────────────────────────────────────