feat: inbound webhooks — public ingest endpoints

core.inbound_hooks (migration 00013): POST /api/v1/hooks/<token> accepts
external events. event mode republishes as inbound.received through the
signed dispatcher + realtime; job mode triggers a scheduled-job run with
the received body as payload. Optional X-Primora-Signature HMAC verify.
Dashboard card on the Integrations page.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

apps/backend/db/queries/inbound_hooks.sql

@@ -0,0 +1,26 @@
+-- name: CreateInboundHook :one
+INSERT INTO core.inbound_hooks (project_id, name, token, mode, job_id, secret, enabled)
+VALUES ($1, $2, $3, $4, $5, $6, $7)
+RETURNING *;
+
+-- name: ListInboundHooks :many
+SELECT * FROM core.inbound_hooks
+WHERE project_id = $1
+ORDER BY name;
+
+-- name: GetInboundHookByToken :one
+SELECT * FROM core.inbound_hooks
+WHERE token = $1;
+
+-- name: GetInboundHook :one
+SELECT * FROM core.inbound_hooks
+WHERE id = $1 AND project_id = $2;
+
+-- name: TouchInboundHook :exec
+UPDATE core.inbound_hooks
+SET last_received_at = NOW()
+WHERE id = $1;
+
+-- name: DeleteInboundHook :exec
+DELETE FROM core.inbound_hooks
+WHERE id = $1 AND project_id = $2;