feat: outgoing webhooks

Owners and admins can point a project at other systems: a signed JSON
POST (HMAC-SHA256 of the body) when tickets, comments, releases or sprints
change, filtered by event or family. Deliveries are retried a couple of
times, the last one is shown, and a ping can be sent from the settings.
Private addresses are refused unless WEBHOOKS_ALLOW_PRIVATE is set.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

libs/api/tracker/presenters/src/lib/tracker-presenters.module.ts

@@ -22,6 +22,8 @@ import { SprintResolver } from './graphql/sprint.resolver';
 import { SprintsController } from './http/sprints.controller';
 import { GitController } from './http/git.controller';
 import { GitResolver } from './graphql/git.resolver';
+import { WebhookResolver } from './graphql/webhook.resolver';
+import { WebhooksController } from './http/webhooks.controller';
 
 /**
  * Driving adapters of the tracker context: GraphQL (queries, mutations,
@@ -54,6 +56,7 @@ import { GitResolver } from './graphql/git.resolver';
     SavedFiltersController,
     SprintsController,
     GitController,
+    WebhooksController,
   ],
   providers: [
     Refs,
@@ -66,6 +69,7 @@ import { GitResolver } from './graphql/git.resolver';
     SavedFilterResolver,
     SprintResolver,
     GitResolver,
+    WebhookResolver,
   ],
 })
 export class TrackerPresentersModule {