feat: outgoing webhooks

Owners and admins can point a project at other systems: a signed JSON
POST (HMAC-SHA256 of the body) when tickets, comments, releases or sprints
change, filtered by event or family. Deliveries are retried a couple of
times, the last one is shown, and a ping can be sent from the settings.
Private addresses are refused unless WEBHOOKS_ALLOW_PRIVATE is set.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

libs/web/tracker/domain/src/lib/models/models.ts

@@ -170,6 +170,27 @@ export interface DevLink {
   at: string;
 }
 
+export interface WebhookDelivery {
+  at: string;
+  event: string;
+  /** HTTP status, null when it never answered. */
+  status: number | null;
+  ok: boolean;
+  error: string | null;
+}
+
+/** Where the project tells another system what happened. */
+export interface Webhook {
+  id: string;
+  url: string;
+  /** Event names, `family.*` or `*`. */
+  events: string[];
+  active: boolean;
+  createdBy: UserRef;
+  createdAt: string;
+  lastDelivery: WebhookDelivery | null;
+}
+
 /** The project's webhook for GitHub, Gitea or GitLab. */
 export interface GitIntegration {
   enabled: boolean;