feat: outgoing webhooks

Owners and admins can point a project at other systems: a signed JSON
POST (HMAC-SHA256 of the body) when tickets, comments, releases or sprints
change, filtered by event or family. Deliveries are retried a couple of
times, the last one is shown, and a ping can be sent from the settings.
Private addresses are refused unless WEBHOOKS_ALLOW_PRIVATE is set.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

libs/web/tracker/presenters/src/lib/pages/settings.page.ts

@@ -17,6 +17,7 @@ import {
 import { NgTemplateOutlet } from '@angular/common';
 import { PiIconComponent, PiNoteComponent } from '@pi/ui';
 import { GitIntegrationComponent } from '../ui/git-integration';
+import { WebhooksComponent } from '../ui/webhooks';
 import { ProjectFacade } from '@task-stream/web/tracker/application';
 import {
   ProjectSettings,
@@ -53,6 +54,7 @@ function idFrom(name: string): string {
   changeDetection: ChangeDetectionStrategy.OnPush,
   imports: [
     GitIntegrationComponent,
+    WebhooksComponent,
     CdkDropList,
     CdkDrag,
     CdkDragHandle,
@@ -468,6 +470,7 @@ function idFrom(name: string): string {
           [projectId]="project.id"
           [projectKey]="project.key"
         />
+        <ts-webhooks [projectId]="project.id" />
       }
 
       @if (facade.isOwner() && facade.project(); as project) {