feat: outgoing webhooks

Owners and admins can point a project at other systems: a signed JSON
POST (HMAC-SHA256 of the body) when tickets, comments, releases or sprints
change, filtered by event or family. Deliveries are retried a couple of
times, the last one is shown, and a ping can be sent from the settings.
Private addresses are refused unless WEBHOOKS_ALLOW_PRIVATE is set.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

libs/api/tracker/presenters/src/lib/http/dto/responses.dto.ts

@@ -167,6 +167,33 @@ export class GitIntegrationDto {
   @ApiProperty({ example: '/api/webhooks/git/3f2c…' }) webhookPath!: string;
 }
 
+export class WebhookDeliveryDto {
+  @ApiProperty({ format: 'date-time' }) at!: string;
+  @ApiProperty({ example: 'issue.created' }) event!: string;
+  @ApiProperty({ type: Number, nullable: true, description: 'HTTP status' })
+  status!: number | null;
+  @ApiProperty() ok!: boolean;
+  @ApiProperty({ type: String, nullable: true }) error!: string | null;
+}
+
+export class WebhookDto {
+  @ApiProperty({ format: 'uuid' }) id!: string;
+  @ApiProperty({ format: 'uuid' }) projectId!: string;
+  @ApiProperty() url!: string;
+  @ApiProperty({ type: [String] }) events!: string[];
+  @ApiProperty() active!: boolean;
+  @ApiProperty({ type: UserRefDto }) createdBy!: UserRefDto;
+  @ApiProperty({ format: 'date-time' }) createdAt!: string;
+  @ApiProperty({ type: WebhookDeliveryDto, nullable: true })
+  lastDelivery!: WebhookDeliveryDto | null;
+}
+
+export class WebhookCreatedDto {
+  @ApiProperty({ format: 'uuid' }) id!: string;
+  @ApiProperty({ description: 'Signs every delivery. Shown only now.' })
+  secret!: string;
+}
+
 export class GitDeliveryResultDto {
   @ApiProperty({ description: 'Tickets that got something new' })
   recorded!: number;