Take Pireon's webhooks: a deactivation or a revocation counts at once

Until now, an account switched off or a token revoked at the identity
server kept working here: bearer tokens until the introspection cache
ran out, panel sessions until they ended, and machine tokens for good,
as they only look at the local account.

POST /api/v1/webhooks/pireon takes user.deactivated (the account goes
inactive, which stops its machine tokens and the panel; its sessions
end and its cached tokens are forgotten) and token.revoked (sessions
and cached tokens go). Pireon signs each delivery with the secret of
the client that registered the webhook, so either PIREON_WEBHOOK_SECRET
(password client) or PIREON_REDIRECT_WEBHOOK_SECRET («Entrar con
Pireon») verifies it; with neither, the endpoint refuses everything.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

public/openapi.yaml

@@ -1054,6 +1054,41 @@ paths:
         "403": { description: Account inactive or awaiting approval }
         "422": { $ref: "#/components/responses/ValidationError" }
 
+  /v1/webhooks/pireon:
+    post:
+      tags: [Auth]
+      summary: Pireon events (called by the identity server, not by apps)
+      description: |
+        `user.deactivated` turns the account off here, ends its panel sessions
+        and forgets its cached bearer tokens; `token.revoked` ends its sessions
+        and forgets its cached tokens. Signed in `X-Webhook-Signature` with the
+        HMAC-SHA256 (hex) of the raw body and the webhook secret of the Pireon
+        client that registered it (`PIREON_WEBHOOK_SECRET` or
+        `PIREON_REDIRECT_WEBHOOK_SECRET`). Disabled while neither is set.
+      security: []
+      parameters:
+        - name: X-Webhook-Signature
+          in: header
+          required: true
+          schema: { type: string }
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required: [event]
+              properties:
+                event: { type: string, example: user.deactivated }
+                data:
+                  type: object
+                  properties:
+                    user_id: { type: integer, example: 4242 }
+      responses:
+        "204": { description: "Processed (or nothing to do)" }
+        "400": { description: No event name }
+        "401": { description: "Missing or invalid signature, or webhooks disabled" }
+
   /v1/me:
     get:
       tags: [Auth]