feat: phase 4 integrations — connectors, rybbit analytics, webhooks

- core.integrations (migration 00005) with AES-256-GCM-encrypted
  credentials (PRIMORA_ENCRYPTION_KEY, hex/base64, dev fallback);
  has_credentials serialization only — secrets never leave the server
- /projects/:id/integrations list/create/delete/test; health check hits
  the stored base URL with a 5s timeout and records status
- Rybbit connector: GET …/integrations/:id/analytics proxies
  /api/organizations + /api/sites/* server-side into a normalized shape
- core.webhooks + core.webhook_deliveries; CRUD, deliveries, test, and
  POST …/deploy-markers. Events: issue.created (new fingerprint on
  ingest), deploy.marker, webhook.test. X-Primora-Signature HMAC-SHA256
  over the raw body; in-process dispatcher, 3 attempts, quadratic
  backoff, 10s timeout, pending-scan on boot
- HTTPS enforced for public targets; HTTP allowed for loopback/private/
  self-hosted sinks
- Integrations page (connectors + webhooks tabs, inline analytics,
  delivery log, secret-shown-once), demo-mode stubs
- 12 new primora_* MCP tools
- workspace 0.4.0

Authored By: TDvorak <[email protected]>

apps/backend/internal/database/db/integrations.sql.go

@@ -0,0 +1,178 @@
+// Code generated by sqlc. DO NOT EDIT.
+// versions:
+//   sqlc v1.29.0
+// source: integrations.sql
+
+package db
+
+import (
+	"context"
+
+	"github.com/google/uuid"
+	"github.com/jackc/pgx/v5/pgtype"
+)
+
+const createIntegration = `-- name: CreateIntegration :one
+INSERT INTO core.integrations (
+  project_id,
+  type,
+  name,
+  base_url,
+  config,
+  credentials,
+  created_by_user_id
+) VALUES ($1, $2, $3, $4, $5, $6, $7)
+RETURNING id, project_id, type, name, base_url, config, credentials, status, last_health_at, created_by_user_id, created_at, updated_at
+`
+
+type CreateIntegrationParams struct {
+	ProjectID       uuid.UUID   `json:"project_id"`
+	Type            string      `json:"type"`
+	Name            string      `json:"name"`
+	BaseUrl         string      `json:"base_url"`
+	Config          []byte      `json:"config"`
+	Credentials     []byte      `json:"credentials"`
+	CreatedByUserID pgtype.UUID `json:"created_by_user_id"`
+}
+
+func (q *Queries) CreateIntegration(ctx context.Context, arg CreateIntegrationParams) (CoreIntegration, error) {
+	row := q.db.QueryRow(ctx, createIntegration,
+		arg.ProjectID,
+		arg.Type,
+		arg.Name,
+		arg.BaseUrl,
+		arg.Config,
+		arg.Credentials,
+		arg.CreatedByUserID,
+	)
+	var i CoreIntegration
+	err := row.Scan(
+		&i.ID,
+		&i.ProjectID,
+		&i.Type,
+		&i.Name,
+		&i.BaseUrl,
+		&i.Config,
+		&i.Credentials,
+		&i.Status,
+		&i.LastHealthAt,
+		&i.CreatedByUserID,
+		&i.CreatedAt,
+		&i.UpdatedAt,
+	)
+	return i, err
+}
+
+const deleteIntegration = `-- name: DeleteIntegration :one
+DELETE FROM core.integrations
+WHERE id = $1
+  AND project_id = $2
+RETURNING id, project_id, type, name, base_url, config, credentials, status, last_health_at, created_by_user_id, created_at, updated_at
+`
+
+type DeleteIntegrationParams struct {
+	ID        uuid.UUID `json:"id"`
+	ProjectID uuid.UUID `json:"project_id"`
+}
+
+func (q *Queries) DeleteIntegration(ctx context.Context, arg DeleteIntegrationParams) (CoreIntegration, error) {
+	row := q.db.QueryRow(ctx, deleteIntegration, arg.ID, arg.ProjectID)
+	var i CoreIntegration
+	err := row.Scan(
+		&i.ID,
+		&i.ProjectID,
+		&i.Type,
+		&i.Name,
+		&i.BaseUrl,
+		&i.Config,
+		&i.Credentials,
+		&i.Status,
+		&i.LastHealthAt,
+		&i.CreatedByUserID,
+		&i.CreatedAt,
+		&i.UpdatedAt,
+	)
+	return i, err
+}
+
+const getIntegrationByID = `-- name: GetIntegrationByID :one
+SELECT id, project_id, type, name, base_url, config, credentials, status, last_health_at, created_by_user_id, created_at, updated_at FROM core.integrations
+WHERE id = $1
+`
+
+func (q *Queries) GetIntegrationByID(ctx context.Context, id uuid.UUID) (CoreIntegration, error) {
+	row := q.db.QueryRow(ctx, getIntegrationByID, id)
+	var i CoreIntegration
+	err := row.Scan(
+		&i.ID,
+		&i.ProjectID,
+		&i.Type,
+		&i.Name,
+		&i.BaseUrl,
+		&i.Config,
+		&i.Credentials,
+		&i.Status,
+		&i.LastHealthAt,
+		&i.CreatedByUserID,
+		&i.CreatedAt,
+		&i.UpdatedAt,
+	)
+	return i, err
+}
+
+const listIntegrations = `-- name: ListIntegrations :many
+SELECT id, project_id, type, name, base_url, config, credentials, status, last_health_at, created_by_user_id, created_at, updated_at FROM core.integrations
+WHERE project_id = $1
+ORDER BY name ASC
+`
+
+func (q *Queries) ListIntegrations(ctx context.Context, projectID uuid.UUID) ([]CoreIntegration, error) {
+	rows, err := q.db.Query(ctx, listIntegrations, projectID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var items []CoreIntegration
+	for rows.Next() {
+		var i CoreIntegration
+		if err := rows.Scan(
+			&i.ID,
+			&i.ProjectID,
+			&i.Type,
+			&i.Name,
+			&i.BaseUrl,
+			&i.Config,
+			&i.Credentials,
+			&i.Status,
+			&i.LastHealthAt,
+			&i.CreatedByUserID,
+			&i.CreatedAt,
+			&i.UpdatedAt,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const updateIntegrationHealth = `-- name: UpdateIntegrationHealth :exec
+UPDATE core.integrations
+SET status = $2,
+    last_health_at = NOW(),
+    updated_at = NOW()
+WHERE id = $1
+`
+
+type UpdateIntegrationHealthParams struct {
+	ID     uuid.UUID `json:"id"`
+	Status string    `json:"status"`
+}
+
+func (q *Queries) UpdateIntegrationHealth(ctx context.Context, arg UpdateIntegrationHealthParams) error {
+	_, err := q.db.Exec(ctx, updateIntegrationHealth, arg.ID, arg.Status)
+	return err
+}