Phase 7: Add signed webhook delivery

[owjs3901]

Summary

• add an administrator-managed webhooks plugin with exact event filters and write-only signing secrets
• deliver committed event envelopes through the phase 3 durable outbox with exponential backoff, per-delivery timeouts, dead-letter history, and manual retry
• sign the exact request body with HMAC-SHA256 and block private, loopback, link-local, and other non-public destinations unless an endpoint explicitly opts out
• document verification, retry, filtering, and SSRF guarantees

Validation

• cargo clippy --workspace --all-targets --all-features -- -D warnings
• cargo test --workspace
• RUSTDOCFLAGS=-D warnings cargo doc --workspace --no-deps
• bunx oxlint
• bun x tsc --noEmit in the app template, example app, and every plugin
• cargo run -p yeollin-cli -- build --skip-backend
• browser QA: create/edit endpoint, write-only secret retention, signed delivery to a real HTTP receiver, five-attempt dead letter, successful manual retry, status filtering, empty states, no console errors, and 390px responsive overflow check