feat: outbound webhooks — signed event delivery + delivery log

Every audited action now emits a "resource.action" event (bare actions
get resource-qualified; already-qualified actions like service.clone
pass through). Webhooks subscribe per-user with exact names, resource.*
wildcards, or *.

- schema: outbound_webhooks + webhook_deliveries (sqlc + goose)
- dispatcher: 4 workers, 512-queue, 3 attempts with backoff, 10s timeout;
  deliveries record status/http-code/body(4KiB)/duration
- signing: X-Containr-Signature sha256=<hmac> over raw body;
  X-Containr-Event + X-Containr-Delivery headers; custom headers per hook
- api: CRUD + /deliveries + /test (ping) under authed group
- fix: SetAuditDB never called — LogAudit was a silent no-op at every
  call site; now wired at boot
- coverage: service create/delete audited (previously uninstrumented)
- cli: containr webhooks list|create|update|delete|deliveries|test
- mcp: 6 tools, delete requires confirm
- frontend: /settings/webhooks page — list/create/expand-deliveries/
  test/disable/delete, secret-shown-once banner; nav + account menu
- openapi + regenerated types; CLI.md + docs snapshot; roadmap ticks

app/frontend/src/app/layout/PlatformShell.tsx

@@ -27,6 +27,7 @@ import {
   UploadCloud,
   User,
   Users,
+  Webhook,
 } from 'lucide-react';
 import {
   getCurrentUserProfile,
@@ -67,6 +68,7 @@ const navSections: NavSection[] = [
     items: [
       { label: 'People', href: '/people', icon: Users, hint: 'Members & access' },
       { label: 'Audit Logs', href: '/settings/audit-logs', icon: ScrollText, hint: 'Activity trail' },
+      { label: 'Webhooks', href: '/settings/webhooks', icon: Webhook, hint: 'Signed event delivery' },
       { label: 'Settings', href: '/settings', icon: Settings, hint: 'Platform preferences' },
       { label: 'Docs', href: '/docs', icon: BookOpen, hint: 'Guides & reference' },
     ],