feat: outgoing webhooks

Owners and admins can point a project at other systems: a signed JSON
POST (HMAC-SHA256 of the body) when tickets, comments, releases or sprints
change, filtered by event or family. Deliveries are retried a couple of
times, the last one is shown, and a ping can be sent from the settings.
Private addresses are refused unless WEBHOOKS_ALLOW_PRIVATE is set.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

libs/web/tracker/domain/src/lib/models/models.ts

@@ -170,6 +170,27 @@ export interface DevLink {
   at: string;
 }
 
+export interface WebhookDelivery {
+  at: string;
+  event: string;
+  /** HTTP status, null when it never answered. */
+  status: number | null;
+  ok: boolean;
+  error: string | null;
+}
+
+/** Where the project tells another system what happened. */
+export interface Webhook {
+  id: string;
+  url: string;
+  /** Event names, `family.*` or `*`. */
+  events: string[];
+  active: boolean;
+  createdBy: UserRef;
+  createdAt: string;
+  lastDelivery: WebhookDelivery | null;
+}
+
 /** The project's webhook for GitHub, Gitea or GitLab. */
 export interface GitIntegration {
   enabled: boolean;

libs/web/tracker/domain/src/lib/ports/gateways.ts

@@ -6,6 +6,8 @@ import {
   Comment,
   Epic,
   GitIntegration,
+  Webhook,
+  WebhookDelivery,
   SavedFilter,
   Sprint,
   SprintBurndown,
@@ -131,6 +133,24 @@ export abstract class IssuesGateway {
   ): Observable<CommandResult>;
 }
 
+/** The project's outgoing webhooks (owners and admins). */
+export abstract class WebhooksGateway {
+  abstract list(projectId: string): Observable<Webhook[]>;
+  abstract events(): Observable<string[]>;
+  /** The secret comes back only here. */
+  abstract create(
+    projectId: string,
+    url: string,
+    events: string[],
+  ): Observable<{ id: string; secret: string }>;
+  abstract update(
+    webhookId: string,
+    changes: { url?: string; events?: string[]; active?: boolean },
+  ): Observable<Webhook>;
+  abstract remove(webhookId: string): Observable<void>;
+  abstract test(webhookId: string): Observable<WebhookDelivery>;
+}
+
 /** The project's Git webhook (owners and admins configure it). */
 export abstract class GitGateway {
   abstract integration(projectId: string): Observable<GitIntegration>;