feat(webhook): inbound delivery audit log

Persists every inbound webhook hit (project + site) so users can debug
"why didn't my deploy fire?" without grepping daemon logs. Surfaces a
14-day rolling history under the WebhookPanel on each project + site
detail page; refreshes every 30s while open. Daily cron prunes records
older than 14 days alongside the existing event log prune.

Schema:
- webhook_deliveries(id, target_type, target_id, target_name, received_at,
  source_ip, signature_state, status_code, outcome, detail, body_size)
- indexes on (target_type,target_id,received_at) and (received_at)

Backend:
- store: WebhookDelivery model + Insert/List/Prune helpers
- webhook/handler: deferred recordDelivery() captures the final outcome
  on every return path including HMAC rejects, image mismatch, no-stage,
  auto_deploy=false, and successful deploys; signatureStateFor()
  classifies "unconfigured" vs "missing" vs "invalid" vs "valid"
- api: GET /api/{projects,sites}/{id}/webhook/deliveries with
  parseLimit() helper (default 50, max 200)
- main: daily prune cron retains the last 14 days

Frontend:
- WebhookDeliveryLog.svelte: panel with refresh button, status code +
  outcome + signature badges, relative time tooltip-on-hover for
  absolute time, source IP column
- Mounted below WebhookPanel on project + site detail pages
- en/ru i18n strings for outcome/signature enums and column labels

web/src/lib/api.ts

@@ -376,6 +376,28 @@ export async function setStaticSiteRequireSignature(siteId: string, require: boo
 	await put<void>(`/api/sites/${siteId}/webhook/require-signature`, { require_signature: require });
 }
 
+export interface WebhookDelivery {
+	id: number;
+	target_type: 'project' | 'site';
+	target_id: string;
+	target_name: string;
+	received_at: string;
+	source_ip: string;
+	signature_state: 'valid' | 'invalid' | 'missing' | 'unconfigured';
+	status_code: number;
+	outcome: string;
+	detail: string;
+	body_size: number;
+}
+
+export function listProjectWebhookDeliveries(projectId: string, signal?: AbortSignal): Promise<WebhookDelivery[]> {
+	return get<WebhookDelivery[]>(`/api/projects/${projectId}/webhook/deliveries`, signal);
+}
+
+export function listStaticSiteWebhookDeliveries(siteId: string, signal?: AbortSignal): Promise<WebhookDelivery[]> {
+	return get<WebhookDelivery[]>(`/api/sites/${siteId}/webhook/deliveries`, signal);
+}
+
 // ── Outgoing-webhook signing & test ────────────────────────────────
 
 export interface NotificationSecretResponse {