feat: phase 4 integrations — connectors, rybbit analytics, webhooks

- core.integrations (migration 00005) with AES-256-GCM-encrypted
  credentials (PRIMORA_ENCRYPTION_KEY, hex/base64, dev fallback);
  has_credentials serialization only — secrets never leave the server
- /projects/:id/integrations list/create/delete/test; health check hits
  the stored base URL with a 5s timeout and records status
- Rybbit connector: GET …/integrations/:id/analytics proxies
  /api/organizations + /api/sites/* server-side into a normalized shape
- core.webhooks + core.webhook_deliveries; CRUD, deliveries, test, and
  POST …/deploy-markers. Events: issue.created (new fingerprint on
  ingest), deploy.marker, webhook.test. X-Primora-Signature HMAC-SHA256
  over the raw body; in-process dispatcher, 3 attempts, quadratic
  backoff, 10s timeout, pending-scan on boot
- HTTPS enforced for public targets; HTTP allowed for loopback/private/
  self-hosted sinks
- Integrations page (connectors + webhooks tabs, inline analytics,
  delivery log, secret-shown-once), demo-mode stubs
- 12 new primora_* MCP tools
- workspace 0.4.0

Authored By: TDvorak <[email protected]>

apps/backend/db/queries/integrations.sql

@@ -0,0 +1,33 @@
+-- name: ListIntegrations :many
+SELECT * FROM core.integrations
+WHERE project_id = $1
+ORDER BY name ASC;
+
+-- name: GetIntegrationByID :one
+SELECT * FROM core.integrations
+WHERE id = $1;
+
+-- name: CreateIntegration :one
+INSERT INTO core.integrations (
+  project_id,
+  type,
+  name,
+  base_url,
+  config,
+  credentials,
+  created_by_user_id
+) VALUES ($1, $2, $3, $4, $5, $6, $7)
+RETURNING *;
+
+-- name: DeleteIntegration :one
+DELETE FROM core.integrations
+WHERE id = $1
+  AND project_id = $2
+RETURNING *;
+
+-- name: UpdateIntegrationHealth :exec
+UPDATE core.integrations
+SET status = $2,
+    last_health_at = NOW(),
+    updated_at = NOW()
+WHERE id = $1;

apps/backend/db/queries/telemetry.sql

@@ -17,6 +17,12 @@ ORDER BY name;
 DELETE FROM core.components
 WHERE id = $1 AND project_id = $2;
 
+-- name: HasFingerprintSeen :one
+SELECT EXISTS(
+  SELECT 1 FROM core.events
+  WHERE project_id = $1 AND fingerprint = $2 AND type = 'error'
+) AS seen;
+
 -- name: InsertEvent :one
 INSERT INTO core.events (project_id, component_id, type, severity, message, payload, fingerprint, ts)
 VALUES ($1, $2, $3, $4, $5, $6, $7, $8)

apps/backend/db/queries/webhooks.sql

@@ -0,0 +1,78 @@
+-- name: ListWebhooks :many
+SELECT * FROM core.webhooks
+WHERE project_id = $1
+ORDER BY created_at ASC;
+
+-- name: GetWebhookByID :one
+SELECT * FROM core.webhooks
+WHERE id = $1;
+
+-- name: ListWebhooksForEvent :many
+SELECT * FROM core.webhooks
+WHERE project_id = $1
+  AND enabled
+  AND (cardinality(events) = 0 OR $2::text = ANY(events));
+
+-- name: CreateWebhook :one
+INSERT INTO core.webhooks (
+  project_id,
+  url,
+  secret,
+  events,
+  enabled,
+  created_by_user_id
+) VALUES ($1, $2, $3, $4, $5, $6)
+RETURNING *;
+
+-- name: UpdateWebhook :one
+UPDATE core.webhooks
+SET url = $3,
+    events = $4,
+    enabled = $5,
+    secret = CASE WHEN $6::boolean THEN $7 ELSE secret END,
+    updated_at = NOW()
+WHERE id = $1
+  AND project_id = $2
+RETURNING *;
+
+-- name: DeleteWebhook :one
+DELETE FROM core.webhooks
+WHERE id = $1
+  AND project_id = $2
+RETURNING *;
+
+-- name: InsertWebhookDelivery :one
+INSERT INTO core.webhook_deliveries (
+  webhook_id,
+  event_type,
+  payload,
+  next_retry_at
+) VALUES ($1, $2, $3, NOW())
+RETURNING *;
+
+-- name: GetWebhookDeliveryByID :one
+SELECT * FROM core.webhook_deliveries
+WHERE id = $1;
+
+-- name: ListWebhookDeliveries :many
+SELECT * FROM core.webhook_deliveries
+WHERE webhook_id = $1
+ORDER BY created_at DESC
+LIMIT $2;
+
+-- name: ListPendingWebhookDeliveries :many
+SELECT * FROM core.webhook_deliveries
+WHERE status = 'pending'
+  AND (next_retry_at IS NULL OR next_retry_at <= NOW())
+ORDER BY created_at
+LIMIT $1;
+
+-- name: MarkWebhookDelivery :exec
+UPDATE core.webhook_deliveries
+SET status = $2,
+    attempts = attempts + 1,
+    last_status_code = $3,
+    last_error = $4,
+    delivered_at = $5,
+    next_retry_at = $6
+WHERE id = $1;