feat: phase 4 integrations — connectors, rybbit analytics, webhooks

- core.integrations (migration 00005) with AES-256-GCM-encrypted
  credentials (PRIMORA_ENCRYPTION_KEY, hex/base64, dev fallback);
  has_credentials serialization only — secrets never leave the server
- /projects/:id/integrations list/create/delete/test; health check hits
  the stored base URL with a 5s timeout and records status
- Rybbit connector: GET …/integrations/:id/analytics proxies
  /api/organizations + /api/sites/* server-side into a normalized shape
- core.webhooks + core.webhook_deliveries; CRUD, deliveries, test, and
  POST …/deploy-markers. Events: issue.created (new fingerprint on
  ingest), deploy.marker, webhook.test. X-Primora-Signature HMAC-SHA256
  over the raw body; in-process dispatcher, 3 attempts, quadratic
  backoff, 10s timeout, pending-scan on boot
- HTTPS enforced for public targets; HTTP allowed for loopback/private/
  self-hosted sinks
- Integrations page (connectors + webhooks tabs, inline analytics,
  delivery log, secret-shown-once), demo-mode stubs
- 12 new primora_* MCP tools
- workspace 0.4.0

Authored By: TDvorak <[email protected]>

apps/backend/internal/config/config.go

@@ -33,8 +33,15 @@ type Config struct {
 	SMTPUser     string
 	SMTPPassword string
 	SMTPSecure   bool
+
+	EncryptionKey string
 }
 
+// devEncryptionKey is the built-in credential key for local development only.
+// Set PRIMORA_ENCRYPTION_KEY in any real deployment — credentials written with
+// this key are readable by anyone with database access.
+const devEncryptionKey = "3031323334353637383961626364656630313233343536373839616263646566"
+
 func Load() (Config, error) {
 	cfg := Config{
 		Env:                   getenv("NODE_ENV", "development"),
@@ -55,6 +62,7 @@ func Load() (Config, error) {
 		SMTPHost:              getenv("SMTP_HOST", "localhost"),
 		SMTPUser:              os.Getenv("SMTP_USER"),
 		SMTPPassword:          os.Getenv("SMTP_PASSWORD"),
+		EncryptionKey:         os.Getenv("PRIMORA_ENCRYPTION_KEY"),
 	}
 
 	smtpPort, err := strconv.Atoi(getenv("SMTP_PORT", "1025"))
@@ -103,6 +111,13 @@ func Load() (Config, error) {
 	if cfg.ResendAPIKey == "" && cfg.SMTPHost == "" {
 		missing = append(missing, "RESEND_API_KEY or SMTP_HOST")
 	}
+	if cfg.EncryptionKey == "" {
+		if cfg.Env == "production" {
+			missing = append(missing, "PRIMORA_ENCRYPTION_KEY")
+		} else {
+			cfg.EncryptionKey = devEncryptionKey
+		}
+	}
 	if len(missing) > 0 {
 		return Config{}, errors.New("missing required environment values: " + strings.Join(missing, ", "))
 	}