feat(webhook): HMAC-SHA256 signature verification on inbound webhooks

Adds an opt-in inbound HMAC scheme so a leaked URL alone is not enough
to forge deploy/sync requests — the caller must also know a separate
signing secret. Header format is X-Hub-Signature-256, matching the
Gitea/GitHub/GitLab convention so existing CI integrations work without
custom code.

Behaviour:
- per-project / per-site signing_secret is independent of the URL secret
- require_signature flag does a hard 401 on missing/invalid signatures
- even when require_signature is off, an *invalid* submitted signature
  returns 401 — surfaces CI misconfiguration instead of silently passing
- comparison uses subtle/hmac.Equal (constant time)

Backend:
- store: webhook_signing_secret + webhook_require_signature columns on
  projects + static_sites; scanProject helper, scan helpers updated; new
  Set* helpers for both fields
- webhook/handler: verifyHMAC helper, body read once, integrated into
  both project and site handlers
- api: per-entity signing-secret rotate / disable / require-toggle
  endpoints under /api/{projects,sites}/{id}/webhook/...

Frontend:
- WebhookPanel gains optional signing handlers (no breaking change for
  existing callers; signing UI hides when handlers aren't wired)
- one-shot reveal of the issued secret with copy + dismiss
- ToggleSwitch for require-signature, disabled until a secret is issued
- en/ru i18n strings

Tests:
- HMACRequiredAndValid (200 + deploy fires)
- HMACRequiredButMissing (401, no deploy)
- HMACPresentButWrong (401 even when require_signature=false)
- HMACOptionalUnsignedAccepted (200 when neither configured)

internal/api/router.go

@@ -245,6 +245,10 @@ func (s *Server) Router() chi.Router {
 					// Per-project webhook URL management.
 					r.Get("/webhook", s.getProjectWebhook)
 					r.Post("/webhook/regenerate", s.regenerateProjectWebhook)
+					// Inbound HMAC signing — secret rotation + enforcement toggle.
+					r.Post("/webhook/signing-secret/regenerate", s.regenerateProjectSigningSecret)
+					r.Delete("/webhook/signing-secret", s.disableProjectSigningSecret)
+					r.Put("/webhook/require-signature", s.updateProjectSigningRequirement)
 
 					// Per-project outgoing-webhook signing & test.
 					r.Get("/notification-secret", s.getProjectNotificationSecret)
@@ -325,6 +329,9 @@ func (s *Server) Router() chi.Router {
 					r.Post("/start", s.startStaticSite)
 					r.Get("/webhook", s.getStaticSiteWebhook)
 					r.Post("/webhook/regenerate", s.regenerateStaticSiteWebhook)
+					r.Post("/webhook/signing-secret/regenerate", s.regenerateStaticSiteSigningSecret)
+					r.Delete("/webhook/signing-secret", s.disableStaticSiteSigningSecret)
+					r.Put("/webhook/require-signature", s.updateStaticSiteSigningRequirement)
 
 					// Per-site outgoing-webhook signing & test.
 					r.Get("/notification-secret", s.getStaticSiteNotificationSecret)