feat: inbound webhooks — public ingest endpoints

core.inbound_hooks (migration 00013): POST /api/v1/hooks/<token> accepts
external events. event mode republishes as inbound.received through the
signed dispatcher + realtime; job mode triggers a scheduled-job run with
the received body as payload. Optional X-Primora-Signature HMAC verify.
Dashboard card on the Integrations page.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

apps/backend/internal/database/db/inbound_hooks.sql.go

@@ -0,0 +1,173 @@
+// Code generated by sqlc. DO NOT EDIT.
+// versions:
+//   sqlc v1.29.0
+// source: inbound_hooks.sql
+
+package db
+
+import (
+	"context"
+
+	"github.com/google/uuid"
+	"github.com/jackc/pgx/v5/pgtype"
+)
+
+const createInboundHook = `-- name: CreateInboundHook :one
+INSERT INTO core.inbound_hooks (project_id, name, token, mode, job_id, secret, enabled)
+VALUES ($1, $2, $3, $4, $5, $6, $7)
+RETURNING id, project_id, name, token, mode, job_id, secret, enabled, last_received_at, created_at, updated_at
+`
+
+type CreateInboundHookParams struct {
+	ProjectID uuid.UUID   `json:"project_id"`
+	Name      string      `json:"name"`
+	Token     string      `json:"token"`
+	Mode      string      `json:"mode"`
+	JobID     pgtype.UUID `json:"job_id"`
+	Secret    []byte      `json:"secret"`
+	Enabled   bool        `json:"enabled"`
+}
+
+func (q *Queries) CreateInboundHook(ctx context.Context, arg CreateInboundHookParams) (CoreInboundHook, error) {
+	row := q.db.QueryRow(ctx, createInboundHook,
+		arg.ProjectID,
+		arg.Name,
+		arg.Token,
+		arg.Mode,
+		arg.JobID,
+		arg.Secret,
+		arg.Enabled,
+	)
+	var i CoreInboundHook
+	err := row.Scan(
+		&i.ID,
+		&i.ProjectID,
+		&i.Name,
+		&i.Token,
+		&i.Mode,
+		&i.JobID,
+		&i.Secret,
+		&i.Enabled,
+		&i.LastReceivedAt,
+		&i.CreatedAt,
+		&i.UpdatedAt,
+	)
+	return i, err
+}
+
+const deleteInboundHook = `-- name: DeleteInboundHook :exec
+DELETE FROM core.inbound_hooks
+WHERE id = $1 AND project_id = $2
+`
+
+type DeleteInboundHookParams struct {
+	ID        uuid.UUID `json:"id"`
+	ProjectID uuid.UUID `json:"project_id"`
+}
+
+func (q *Queries) DeleteInboundHook(ctx context.Context, arg DeleteInboundHookParams) error {
+	_, err := q.db.Exec(ctx, deleteInboundHook, arg.ID, arg.ProjectID)
+	return err
+}
+
+const getInboundHook = `-- name: GetInboundHook :one
+SELECT id, project_id, name, token, mode, job_id, secret, enabled, last_received_at, created_at, updated_at FROM core.inbound_hooks
+WHERE id = $1 AND project_id = $2
+`
+
+type GetInboundHookParams struct {
+	ID        uuid.UUID `json:"id"`
+	ProjectID uuid.UUID `json:"project_id"`
+}
+
+func (q *Queries) GetInboundHook(ctx context.Context, arg GetInboundHookParams) (CoreInboundHook, error) {
+	row := q.db.QueryRow(ctx, getInboundHook, arg.ID, arg.ProjectID)
+	var i CoreInboundHook
+	err := row.Scan(
+		&i.ID,
+		&i.ProjectID,
+		&i.Name,
+		&i.Token,
+		&i.Mode,
+		&i.JobID,
+		&i.Secret,
+		&i.Enabled,
+		&i.LastReceivedAt,
+		&i.CreatedAt,
+		&i.UpdatedAt,
+	)
+	return i, err
+}
+
+const getInboundHookByToken = `-- name: GetInboundHookByToken :one
+SELECT id, project_id, name, token, mode, job_id, secret, enabled, last_received_at, created_at, updated_at FROM core.inbound_hooks
+WHERE token = $1
+`
+
+func (q *Queries) GetInboundHookByToken(ctx context.Context, token string) (CoreInboundHook, error) {
+	row := q.db.QueryRow(ctx, getInboundHookByToken, token)
+	var i CoreInboundHook
+	err := row.Scan(
+		&i.ID,
+		&i.ProjectID,
+		&i.Name,
+		&i.Token,
+		&i.Mode,
+		&i.JobID,
+		&i.Secret,
+		&i.Enabled,
+		&i.LastReceivedAt,
+		&i.CreatedAt,
+		&i.UpdatedAt,
+	)
+	return i, err
+}
+
+const listInboundHooks = `-- name: ListInboundHooks :many
+SELECT id, project_id, name, token, mode, job_id, secret, enabled, last_received_at, created_at, updated_at FROM core.inbound_hooks
+WHERE project_id = $1
+ORDER BY name
+`
+
+func (q *Queries) ListInboundHooks(ctx context.Context, projectID uuid.UUID) ([]CoreInboundHook, error) {
+	rows, err := q.db.Query(ctx, listInboundHooks, projectID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var items []CoreInboundHook
+	for rows.Next() {
+		var i CoreInboundHook
+		if err := rows.Scan(
+			&i.ID,
+			&i.ProjectID,
+			&i.Name,
+			&i.Token,
+			&i.Mode,
+			&i.JobID,
+			&i.Secret,
+			&i.Enabled,
+			&i.LastReceivedAt,
+			&i.CreatedAt,
+			&i.UpdatedAt,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const touchInboundHook = `-- name: TouchInboundHook :exec
+UPDATE core.inbound_hooks
+SET last_received_at = NOW()
+WHERE id = $1
+`
+
+func (q *Queries) TouchInboundHook(ctx context.Context, id uuid.UUID) error {
+	_, err := q.db.Exec(ctx, touchInboundHook, id)
+	return err
+}