feat: outgoing webhooks

Owners and admins can point a project at other systems: a signed JSON
POST (HMAC-SHA256 of the body) when tickets, comments, releases or sprints
change, filtered by event or family. Deliveries are retried a couple of
times, the last one is shown, and a ping can be sent from the settings.
Private addresses are refused unless WEBHOOKS_ALLOW_PRIVATE is set.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

libs/web/tracker/domain/src/lib/ports/gateways.ts

@@ -6,6 +6,8 @@ import {
   Comment,
   Epic,
   GitIntegration,
+  Webhook,
+  WebhookDelivery,
   SavedFilter,
   Sprint,
   SprintBurndown,
@@ -131,6 +133,24 @@ export abstract class IssuesGateway {
   ): Observable<CommandResult>;
 }
 
+/** The project's outgoing webhooks (owners and admins). */
+export abstract class WebhooksGateway {
+  abstract list(projectId: string): Observable<Webhook[]>;
+  abstract events(): Observable<string[]>;
+  /** The secret comes back only here. */
+  abstract create(
+    projectId: string,
+    url: string,
+    events: string[],
+  ): Observable<{ id: string; secret: string }>;
+  abstract update(
+    webhookId: string,
+    changes: { url?: string; events?: string[]; active?: boolean },
+  ): Observable<Webhook>;
+  abstract remove(webhookId: string): Observable<void>;
+  abstract test(webhookId: string): Observable<WebhookDelivery>;
+}
+
 /** The project's Git webhook (owners and admins configure it). */
 export abstract class GitGateway {
   abstract integration(projectId: string): Observable<GitIntegration>;