feat: outgoing webhooks

Owners and admins can point a project at other systems: a signed JSON
POST (HMAC-SHA256 of the body) when tickets, comments, releases or sprints
change, filtered by event or family. Deliveries are retried a couple of
times, the last one is shown, and a ping can be sent from the settings.
Private addresses are refused unless WEBHOOKS_ALLOW_PRIVATE is set.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

libs/web/tracker/infrastructure/src/lib/tracker-infrastructure.providers.ts

@@ -13,6 +13,7 @@ import {
   SavedFiltersGateway,
   SprintsGateway,
   GitGateway,
+  WebhooksGateway,
   TrackerRealtimeGateway,
   UsersGateway,
 } from '@task-stream/web/tracker/domain';
@@ -30,6 +31,7 @@ import { GraphqlRealtimeGateway } from './adapters/graphql-realtime.gateway';
 import { GraphqlSavedFiltersGateway } from './adapters/graphql-saved-filters.gateway';
 import { GraphqlSprintsGateway } from './adapters/graphql-sprints.gateway';
 import { GraphqlGitGateway } from './adapters/graphql-git.gateway';
+import { GraphqlWebhooksGateway } from './adapters/graphql-webhooks.gateway';
 
 /** Ports → GraphQL adapters (and REST for files). */
 export function provideTrackerInfrastructure(): EnvironmentProviders {
@@ -46,5 +48,6 @@ export function provideTrackerInfrastructure(): EnvironmentProviders {
     { provide: SavedFiltersGateway, useClass: GraphqlSavedFiltersGateway },
     { provide: SprintsGateway, useClass: GraphqlSprintsGateway },
     { provide: GitGateway, useClass: GraphqlGitGateway },
+    { provide: WebhooksGateway, useClass: GraphqlWebhooksGateway },
   ]);
 }