feat: phase 4 integrations — connectors, rybbit analytics, webhooks

- core.integrations (migration 00005) with AES-256-GCM-encrypted
  credentials (PRIMORA_ENCRYPTION_KEY, hex/base64, dev fallback);
  has_credentials serialization only — secrets never leave the server
- /projects/:id/integrations list/create/delete/test; health check hits
  the stored base URL with a 5s timeout and records status
- Rybbit connector: GET …/integrations/:id/analytics proxies
  /api/organizations + /api/sites/* server-side into a normalized shape
- core.webhooks + core.webhook_deliveries; CRUD, deliveries, test, and
  POST …/deploy-markers. Events: issue.created (new fingerprint on
  ingest), deploy.marker, webhook.test. X-Primora-Signature HMAC-SHA256
  over the raw body; in-process dispatcher, 3 attempts, quadratic
  backoff, 10s timeout, pending-scan on boot
- HTTPS enforced for public targets; HTTP allowed for loopback/private/
  self-hosted sinks
- Integrations page (connectors + webhooks tabs, inline analytics,
  delivery log, secret-shown-once), demo-mode stubs
- 12 new primora_* MCP tools
- workspace 0.4.0

Authored By: TDvorak <[email protected]>

apps/backend/internal/secrets/secrets.go

@@ -0,0 +1,76 @@
+// Package secrets encrypts credential payloads at rest with AES-256-GCM.
+// Ciphertext layout: nonce || ciphertext.
+package secrets
+
+import (
+	"crypto/aes"
+	"crypto/cipher"
+	"crypto/rand"
+	"encoding/base64"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"io"
+	"strings"
+)
+
+type Encryptor struct {
+	aead cipher.AEAD
+}
+
+// NewEncryptor accepts a 32-byte key as hex or base64 (std or raw encoding).
+func NewEncryptor(raw string) (*Encryptor, error) {
+	key, err := decodeKey(raw)
+	if err != nil {
+		return nil, err
+	}
+	block, err := aes.NewCipher(key)
+	if err != nil {
+		return nil, fmt.Errorf("init cipher: %w", err)
+	}
+	aead, err := cipher.NewGCM(block)
+	if err != nil {
+		return nil, fmt.Errorf("init gcm: %w", err)
+	}
+	return &Encryptor{aead: aead}, nil
+}
+
+func decodeKey(raw string) ([]byte, error) {
+	trimmed := strings.TrimSpace(raw)
+	if trimmed == "" {
+		return nil, errors.New("encryption key is empty")
+	}
+	for _, decode := range []func(string) ([]byte, error){
+		hex.DecodeString,
+		base64.StdEncoding.DecodeString,
+		base64.RawStdEncoding.DecodeString,
+		base64.URLEncoding.DecodeString,
+		base64.RawURLEncoding.DecodeString,
+	} {
+		key, err := decode(trimmed)
+		if err == nil && len(key) == 32 {
+			return key, nil
+		}
+	}
+	return nil, errors.New("encryption key must decode to 32 bytes (hex or base64)")
+}
+
+func (e *Encryptor) Encrypt(plaintext []byte) ([]byte, error) {
+	nonce := make([]byte, e.aead.NonceSize())
+	if _, err := io.ReadFull(rand.Reader, nonce); err != nil {
+		return nil, fmt.Errorf("nonce: %w", err)
+	}
+	return e.aead.Seal(nonce, nonce, plaintext, nil), nil
+}
+
+func (e *Encryptor) Decrypt(ciphertext []byte) ([]byte, error) {
+	if len(ciphertext) < e.aead.NonceSize() {
+		return nil, errors.New("ciphertext too short")
+	}
+	nonce, body := ciphertext[:e.aead.NonceSize()], ciphertext[e.aead.NonceSize():]
+	plain, err := e.aead.Open(nil, nonce, body, nil)
+	if err != nil {
+		return nil, fmt.Errorf("decrypt: %w", err)
+	}
+	return plain, nil
+}

apps/backend/internal/secrets/secrets_test.go

@@ -0,0 +1,85 @@
+package secrets
+
+import (
+	"encoding/base64"
+	"encoding/hex"
+	"testing"
+)
+
+const testKeyHex = "3031323334353637383961626364656630313233343536373839616263646566"
+
+func TestRoundTrip(t *testing.T) {
+	enc, err := NewEncryptor(testKeyHex)
+	if err != nil {
+		t.Fatalf("NewEncryptor: %v", err)
+	}
+	plain := []byte(`{"api_key":"ryb-secret-token"}`)
+	ciphertext, err := enc.Encrypt(plain)
+	if err != nil {
+		t.Fatalf("Encrypt: %v", err)
+	}
+	if string(ciphertext) == string(plain) {
+		t.Fatal("ciphertext contains plaintext")
+	}
+	got, err := enc.Decrypt(ciphertext)
+	if err != nil {
+		t.Fatalf("Decrypt: %v", err)
+	}
+	if string(got) != string(plain) {
+		t.Fatalf("round trip mismatch: got %q", got)
+	}
+}
+
+func TestKeyDecoding(t *testing.T) {
+	raw := make([]byte, 32)
+	for i := range raw {
+		raw[i] = byte(i)
+	}
+	for name, key := range map[string]string{
+		"hex":        hex.EncodeToString(raw),
+		"base64":     base64.StdEncoding.EncodeToString(raw),
+		"base64-raw": base64.RawStdEncoding.EncodeToString(raw),
+		"base64-url": base64.URLEncoding.EncodeToString(raw),
+		"whitespace": "  " + hex.EncodeToString(raw) + "\n",
+	} {
+		if _, err := NewEncryptor(key); err != nil {
+			t.Errorf("%s: %v", name, err)
+		}
+	}
+}
+
+func TestRejectsBadKeys(t *testing.T) {
+	for _, key := range []string{
+		"",
+		"too-short-hex",
+		hex.EncodeToString([]byte("sixteen-byte-key")),
+		"!!!not-encoded!!!",
+	} {
+		if _, err := NewEncryptor(key); err == nil {
+			t.Errorf("expected error for key %q", key)
+		}
+	}
+}
+
+func TestDecryptRejectsGarbage(t *testing.T) {
+	enc, err := NewEncryptor(testKeyHex)
+	if err != nil {
+		t.Fatalf("NewEncryptor: %v", err)
+	}
+	if _, err := enc.Decrypt([]byte("short")); err == nil {
+		t.Error("expected error for short ciphertext")
+	}
+	if _, err := enc.Decrypt(make([]byte, 64)); err == nil {
+		t.Error("expected error for unauthenticated ciphertext")
+	}
+}
+
+func TestCrossKeyFails(t *testing.T) {
+	a, _ := NewEncryptor(testKeyHex)
+	other := hex.EncodeToString([]byte("0123456789abcdef0123456789abcde0"))
+	b, _ := NewEncryptor(other)
+	ciphertext, _ := a.Encrypt([]byte("secret"))
+	if _, err := b.Decrypt(ciphertext); err == nil {
+		t.Error("expected decryption to fail with a different key")
+	}
+}