feat: outgoing webhooks

Owners and admins can point a project at other systems: a signed JSON
POST (HMAC-SHA256 of the body) when tickets, comments, releases or sprints
change, filtered by event or family. Deliveries are retried a couple of
times, the last one is shown, and a ping can be sent from the settings.
Private addresses are refused unless WEBHOOKS_ALLOW_PRIVATE is set.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

libs/api/tracker/presenters/src/lib/http/dto/requests.dto.ts

@@ -731,6 +731,29 @@ export class SaveFilterDto {
   criteria!: SavedFilterCriteriaDto;
 }
 
+export class CreateWebhookDto {
+  @ApiProperty({ example: 'https://chat.example.org/hooks/taskstream' })
+  @IsUrl({ require_tld: false, require_protocol: true })
+  url!: string;
+
+  @ApiProperty({
+    type: [String],
+    example: ['issue.status_changed', 'release.*'],
+    description: 'Event names (GET /api/webhook-events), family.* or *',
+  })
+  @IsArray()
+  @ArrayMaxSize(50)
+  @IsString({ each: true })
+  events!: string[];
+}
+
+export class UpdateWebhookDto extends PartialType(CreateWebhookDto) {
+  @ApiPropertyOptional({ description: 'Paused webhooks get nothing' })
+  @IsOptional()
+  @IsBoolean()
+  active?: boolean;
+}
+
 export class RankIssueDto {
   @ApiPropertyOptional({
     type: String,