feat: phase 4 integrations — connectors, rybbit analytics, webhooks

- core.integrations (migration 00005) with AES-256-GCM-encrypted
  credentials (PRIMORA_ENCRYPTION_KEY, hex/base64, dev fallback);
  has_credentials serialization only — secrets never leave the server
- /projects/:id/integrations list/create/delete/test; health check hits
  the stored base URL with a 5s timeout and records status
- Rybbit connector: GET …/integrations/:id/analytics proxies
  /api/organizations + /api/sites/* server-side into a normalized shape
- core.webhooks + core.webhook_deliveries; CRUD, deliveries, test, and
  POST …/deploy-markers. Events: issue.created (new fingerprint on
  ingest), deploy.marker, webhook.test. X-Primora-Signature HMAC-SHA256
  over the raw body; in-process dispatcher, 3 attempts, quadratic
  backoff, 10s timeout, pending-scan on boot
- HTTPS enforced for public targets; HTTP allowed for loopback/private/
  self-hosted sinks
- Integrations page (connectors + webhooks tabs, inline analytics,
  delivery log, secret-shown-once), demo-mode stubs
- 12 new primora_* MCP tools
- workspace 0.4.0

Authored By: TDvorak <[email protected]>

ROADMAP.md

@@ -83,15 +83,21 @@ IMS (`~/Desktop/PROG+HTML/IMS`) is discontinued and folded in — same stack
   `primora_telemetry_stats`, `primora_metric_series` in `apps/mcp`.
 - Migration note in IMS repo README → archive, point at Primora.
 
-## Phase 4 — Integrations
+## Phase 4 — Integrations ✅
 
-- **Connector framework** — per-project external services: type, base URL,
-  credentials (encrypted at rest), health check. `core.integrations` table.
-- **Rybbit connector** — user supplies their self-hosted Rybbit URL + API key;
-  Primora pulls site stats into a project **Analytics** page and dashboard
-  widgets. Read-only, no tracking proxy.
-- **Webhooks** — outbound events (issue created, deploy marker) to arbitrary
-  URLs, so Primora can push into other self-hosted tools.
+- ~~**Connector framework**~~ — `core.integrations` (migration 00005): type,
+  base URL, AES-256-GCM-encrypted credentials (`PRIMORA_ENCRYPTION_KEY`),
+  health check (`POST …/test`). `has_credentials` only — secrets never
+  serialized.
+- ~~**Rybbit connector**~~ — self-hosted URL + API key;
+  `GET …/integrations/:id/analytics` normalizes overview/series/top
+  pages/referrers server-side. Integrations page carries the per-connector
+  analytics panel. Read-only, no tracking proxy.
+- ~~**Webhooks**~~ — `core.webhooks` + `core.webhook_deliveries`; events
+  `issue.created` (new fingerprint on ingest), `deploy.marker`
+  (`POST …/deploy-markers`), `webhook.test`. HMAC-SHA256 signature header
+  (`X-Primora-Signature`), in-process dispatcher with backoff retries, HTTPS
+  for public targets (HTTP allowed for private/self-hosted sinks).
 
 ## Phase 5 — Distribution