feat: phase 4 integrations — connectors, rybbit analytics, webhooks

- core.integrations (migration 00005) with AES-256-GCM-encrypted
  credentials (PRIMORA_ENCRYPTION_KEY, hex/base64, dev fallback);
  has_credentials serialization only — secrets never leave the server
- /projects/:id/integrations list/create/delete/test; health check hits
  the stored base URL with a 5s timeout and records status
- Rybbit connector: GET …/integrations/:id/analytics proxies
  /api/organizations + /api/sites/* server-side into a normalized shape
- core.webhooks + core.webhook_deliveries; CRUD, deliveries, test, and
  POST …/deploy-markers. Events: issue.created (new fingerprint on
  ingest), deploy.marker, webhook.test. X-Primora-Signature HMAC-SHA256
  over the raw body; in-process dispatcher, 3 attempts, quadratic
  backoff, 10s timeout, pending-scan on boot
- HTTPS enforced for public targets; HTTP allowed for loopback/private/
  self-hosted sinks
- Integrations page (connectors + webhooks tabs, inline analytics,
  delivery log, secret-shown-once), demo-mode stubs
- 12 new primora_* MCP tools
- workspace 0.4.0

Authored By: TDvorak <[email protected]>

apps/backend/internal/database/db/models.go

@@ -242,6 +242,21 @@ type CoreEvent struct {
 	Ts          pgtype.Timestamptz `json:"ts"`
 }
 
+type CoreIntegration struct {
+	ID              uuid.UUID          `json:"id"`
+	ProjectID       uuid.UUID          `json:"project_id"`
+	Type            string             `json:"type"`
+	Name            string             `json:"name"`
+	BaseUrl         string             `json:"base_url"`
+	Config          []byte             `json:"config"`
+	Credentials     []byte             `json:"credentials"`
+	Status          string             `json:"status"`
+	LastHealthAt    pgtype.Timestamptz `json:"last_health_at"`
+	CreatedByUserID pgtype.UUID        `json:"created_by_user_id"`
+	CreatedAt       pgtype.Timestamptz `json:"created_at"`
+	UpdatedAt       pgtype.Timestamptz `json:"updated_at"`
+}
+
 type CoreOrganization struct {
 	ID        uuid.UUID          `json:"id"`
 	Slug      string             `json:"slug"`
@@ -298,3 +313,29 @@ type CoreUser struct {
 	UpdatedAt     pgtype.Timestamptz `json:"updated_at"`
 	LastSeenAt    pgtype.Timestamptz `json:"last_seen_at"`
 }
+
+type CoreWebhook struct {
+	ID              uuid.UUID          `json:"id"`
+	ProjectID       uuid.UUID          `json:"project_id"`
+	Url             string             `json:"url"`
+	Secret          []byte             `json:"secret"`
+	Events          []string           `json:"events"`
+	Enabled         bool               `json:"enabled"`
+	CreatedByUserID pgtype.UUID        `json:"created_by_user_id"`
+	CreatedAt       pgtype.Timestamptz `json:"created_at"`
+	UpdatedAt       pgtype.Timestamptz `json:"updated_at"`
+}
+
+type CoreWebhookDelivery struct {
+	ID             uuid.UUID          `json:"id"`
+	WebhookID      uuid.UUID          `json:"webhook_id"`
+	EventType      string             `json:"event_type"`
+	Payload        []byte             `json:"payload"`
+	Status         string             `json:"status"`
+	Attempts       int32              `json:"attempts"`
+	LastStatusCode *int32             `json:"last_status_code"`
+	LastError      string             `json:"last_error"`
+	DeliveredAt    pgtype.Timestamptz `json:"delivered_at"`
+	NextRetryAt    pgtype.Timestamptz `json:"next_retry_at"`
+	CreatedAt      pgtype.Timestamptz `json:"created_at"`
+}