feat: inbound webhooks — public ingest endpoints

core.inbound_hooks (migration 00013): POST /api/v1/hooks/<token> accepts
external events. event mode republishes as inbound.received through the
signed dispatcher + realtime; job mode triggers a scheduled-job run with
the received body as payload. Optional X-Primora-Signature HMAC verify.
Dashboard card on the Integrations page.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

apps/backend/internal/handlers/http.go

@@ -79,6 +79,10 @@ func (h *HTTPHandler) Register(router *gin.Engine) {
 	api.DELETE("/collections/:collectionID/documents/:documentID", h.deleteDocument)
 	api.OPTIONS("/ingest", h.ingestOptions)
 	api.POST("/ingest", h.ingest)
+	api.POST("/hooks/:token", h.receiveInboundHook)
+	api.GET("/projects/:projectID/inbound-hooks", h.listInboundHooks)
+	api.POST("/projects/:projectID/inbound-hooks", h.createInboundHook)
+	api.DELETE("/projects/:projectID/inbound-hooks/:hookID", h.deleteInboundHook)
 	api.GET("/projects/:projectID/events", h.listEvents)
 	api.GET("/projects/:projectID/issues", h.listIssues)
 	api.GET("/projects/:projectID/components", h.listComponents)

apps/backend/internal/handlers/inbound.go

@@ -0,0 +1,97 @@
+package handlers
+
+import (
+	"errors"
+	"io"
+	"net/http"
+	"strings"
+
+	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
+	"github.com/jackc/pgx/v5"
+
+	"github.com/tdvorak/primora/apps/backend/internal/middleware"
+	apperrors "github.com/tdvorak/primora/apps/backend/internal/response"
+	"github.com/tdvorak/primora/apps/backend/internal/services"
+)
+
+const maxInboundBody = 256 * 1024 // external POSTs capped at 256 KiB
+
+func (h *HTTPHandler) inboundError(c *gin.Context, err error) {
+	if errors.Is(err, pgx.ErrNoRows) {
+		apperrors.Abort(c, http.StatusNotFound, "not_found", "hook not found")
+		return
+	}
+	msg := err.Error()
+	switch {
+	case strings.Contains(msg, "invalid signature"):
+		apperrors.Abort(c, http.StatusUnauthorized, "unauthorized", msg)
+	case strings.Contains(msg, "invalid") || strings.Contains(msg, "already exists") || strings.Contains(msg, "disabled") || strings.Contains(msg, "requires") || strings.Contains(msg, "not found in this project"):
+		apperrors.Abort(c, http.StatusBadRequest, "bad_request", msg)
+	default:
+		h.handleError(c, err)
+	}
+}
+
+func (h *HTTPHandler) listInboundHooks(c *gin.Context) {
+	actor, projectID, ok := h.actorAndProject(c)
+	if !ok {
+		return
+	}
+	result, err := h.Platform.ListInboundHooks(c.Request.Context(), actor, projectID)
+	if err != nil {
+		h.inboundError(c, err)
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"items": result})
+}
+
+func (h *HTTPHandler) createInboundHook(c *gin.Context) {
+	actor, projectID, ok := h.actorAndProject(c)
+	if !ok {
+		return
+	}
+	var body services.CreateInboundHookInput
+	if !h.bindAndValidate(c, &body) {
+		return
+	}
+	result, err := h.Platform.CreateInboundHook(c.Request.Context(), actor, projectID, body, middleware.RequestIDFromContext(c))
+	if err != nil {
+		h.inboundError(c, err)
+		return
+	}
+	c.JSON(http.StatusCreated, result)
+}
+
+func (h *HTTPHandler) deleteInboundHook(c *gin.Context) {
+	actor, projectID, ok := h.actorAndProject(c)
+	if !ok {
+		return
+	}
+	hookID, err := uuid.Parse(c.Param("hookID"))
+	if err != nil {
+		apperrors.Abort(c, http.StatusBadRequest, "bad_request", "invalid hook id")
+		return
+	}
+	if err := h.Platform.DeleteInboundHook(c.Request.Context(), actor, projectID, hookID, middleware.RequestIDFromContext(c)); err != nil {
+		h.inboundError(c, err)
+		return
+	}
+	c.Status(http.StatusNoContent)
+}
+
+// receiveInboundHook is the public ingest endpoint — the URL token is the
+// credential, so no actor is required.
+func (h *HTTPHandler) receiveInboundHook(c *gin.Context) {
+	body, err := io.ReadAll(http.MaxBytesReader(c.Writer, c.Request.Body, maxInboundBody))
+	if err != nil {
+		apperrors.Abort(c, http.StatusRequestEntityTooLarge, "too_large", "body exceeds 256 KiB")
+		return
+	}
+	result, err := h.Platform.ReceiveInboundHook(c.Request.Context(), c.Param("token"), c.GetHeader("X-Primora-Signature"), body)
+	if err != nil {
+		h.inboundError(c, err)
+		return
+	}
+	c.JSON(http.StatusAccepted, result)
+}