feat: phase 4 integrations — connectors, rybbit analytics, webhooks

- core.integrations (migration 00005) with AES-256-GCM-encrypted
  credentials (PRIMORA_ENCRYPTION_KEY, hex/base64, dev fallback);
  has_credentials serialization only — secrets never leave the server
- /projects/:id/integrations list/create/delete/test; health check hits
  the stored base URL with a 5s timeout and records status
- Rybbit connector: GET …/integrations/:id/analytics proxies
  /api/organizations + /api/sites/* server-side into a normalized shape
- core.webhooks + core.webhook_deliveries; CRUD, deliveries, test, and
  POST …/deploy-markers. Events: issue.created (new fingerprint on
  ingest), deploy.marker, webhook.test. X-Primora-Signature HMAC-SHA256
  over the raw body; in-process dispatcher, 3 attempts, quadratic
  backoff, 10s timeout, pending-scan on boot
- HTTPS enforced for public targets; HTTP allowed for loopback/private/
  self-hosted sinks
- Integrations page (connectors + webhooks tabs, inline analytics,
  delivery log, secret-shown-once), demo-mode stubs
- 12 new primora_* MCP tools
- workspace 0.4.0

Authored By: TDvorak <[email protected]>

apps/backend/db/migrations/00005_integrations.sql

@@ -0,0 +1,56 @@
+-- +goose Up
+CREATE TABLE core.integrations (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  project_id UUID NOT NULL REFERENCES core.projects(id) ON DELETE CASCADE,
+  type TEXT NOT NULL CHECK (type IN ('rybbit')),
+  name TEXT NOT NULL,
+  base_url TEXT NOT NULL,
+  config JSONB NOT NULL DEFAULT '{}'::jsonb,
+  credentials BYTEA NOT NULL DEFAULT ''::bytea,
+  status TEXT NOT NULL DEFAULT 'unknown' CHECK (status IN ('unknown', 'ok', 'error')),
+  last_health_at TIMESTAMPTZ,
+  created_by_user_id UUID REFERENCES core.users(id) ON DELETE SET NULL,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+  UNIQUE (project_id, name)
+);
+
+CREATE INDEX idx_integrations_project_id ON core.integrations(project_id);
+
+CREATE TABLE core.webhooks (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  project_id UUID NOT NULL REFERENCES core.projects(id) ON DELETE CASCADE,
+  url TEXT NOT NULL,
+  secret BYTEA NOT NULL DEFAULT ''::bytea,
+  events TEXT[] NOT NULL DEFAULT '{}',
+  enabled BOOLEAN NOT NULL DEFAULT TRUE,
+  created_by_user_id UUID REFERENCES core.users(id) ON DELETE SET NULL,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+  UNIQUE (project_id, url)
+);
+
+CREATE INDEX idx_webhooks_project_id ON core.webhooks(project_id);
+
+CREATE TABLE core.webhook_deliveries (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  webhook_id UUID NOT NULL REFERENCES core.webhooks(id) ON DELETE CASCADE,
+  event_type TEXT NOT NULL,
+  payload JSONB NOT NULL DEFAULT '{}'::jsonb,
+  status TEXT NOT NULL DEFAULT 'pending' CHECK (status IN ('pending', 'delivered', 'failed')),
+  attempts INT NOT NULL DEFAULT 0,
+  last_status_code INT,
+  last_error TEXT NOT NULL DEFAULT '',
+  delivered_at TIMESTAMPTZ,
+  next_retry_at TIMESTAMPTZ,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX idx_webhook_deliveries_webhook ON core.webhook_deliveries(webhook_id, created_at DESC);
+CREATE INDEX idx_webhook_deliveries_retry ON core.webhook_deliveries(next_retry_at)
+  WHERE status = 'pending';
+
+-- +goose Down
+DROP TABLE IF EXISTS core.webhook_deliveries;
+DROP TABLE IF EXISTS core.webhooks;
+DROP TABLE IF EXISTS core.integrations;