fix(api): accept Pireon webhooks from the password client too

Pireon signs each webhook with the secret of the client that registered
it, and the API has two clients (the web app's and the password
grant's). Only PIREON_WEBHOOK_SECRET was accepted, so a token revoked
for someone signed in with a password went unheard. A delivery now
verifies with PIREON_WEBHOOK_SECRET or PIREON_PASSWORD_WEBHOOK_SECRET;
the same event arriving from both clients changes nothing.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.env.example

@@ -16,8 +16,11 @@ EVENTS_BRIDGE_ENABLED=true
 
 # Pireon identity server (https://oauth.pireon.dev/api/documentation)
 PIREON_BASE_URL=https://oauth.pireon.dev
-# Secret returned when registering the webhook (POST /api/clients/{client}/webhooks)
+# Secret returned when registering the webhook (POST /api/clients/{client}/webhooks).
+# Pireon signs with the secret of the client that registered it: one per client.
 PIREON_WEBHOOK_SECRET=
+# The password client's webhook, if it has its own
+PIREON_PASSWORD_WEBHOOK_SECRET=
 # OAuth clients of task-stream in Pireon (POST /api/clients). Each Pireon client allows ONE grant type:
 #   authorization_code → "Sign in with Pireon" and Swagger UI. Redirect URIs to register:
 #     http://localhost:4200/auth/callback, http://localhost:3000/api/docs/oauth2-redirect.html