feat: phase 4 integrations — connectors, rybbit analytics, webhooks

- core.integrations (migration 00005) with AES-256-GCM-encrypted
  credentials (PRIMORA_ENCRYPTION_KEY, hex/base64, dev fallback);
  has_credentials serialization only — secrets never leave the server
- /projects/:id/integrations list/create/delete/test; health check hits
  the stored base URL with a 5s timeout and records status
- Rybbit connector: GET …/integrations/:id/analytics proxies
  /api/organizations + /api/sites/* server-side into a normalized shape
- core.webhooks + core.webhook_deliveries; CRUD, deliveries, test, and
  POST …/deploy-markers. Events: issue.created (new fingerprint on
  ingest), deploy.marker, webhook.test. X-Primora-Signature HMAC-SHA256
  over the raw body; in-process dispatcher, 3 attempts, quadratic
  backoff, 10s timeout, pending-scan on boot
- HTTPS enforced for public targets; HTTP allowed for loopback/private/
  self-hosted sinks
- Integrations page (connectors + webhooks tabs, inline analytics,
  delivery log, secret-shown-once), demo-mode stubs
- 12 new primora_* MCP tools
- workspace 0.4.0

Authored By: TDvorak <[email protected]>

packages/api-client/src/generated/schemas/$Integration.ts

@@ -0,0 +1,51 @@
+/* generated using openapi-typescript-codegen -- do not edit */
+/* istanbul ignore file */
+/* tslint:disable */
+/* eslint-disable */
+export const $Integration = {
+    properties: {
+        id: {
+            type: 'string',
+            isRequired: true,
+            format: 'uuid',
+        },
+        project_id: {
+            type: 'string',
+            isRequired: true,
+            format: 'uuid',
+        },
+        type: {
+            type: 'Enum',
+            isRequired: true,
+        },
+        name: {
+            type: 'string',
+            isRequired: true,
+        },
+        base_url: {
+            type: 'string',
+            isRequired: true,
+        },
+        site_id: {
+            type: 'string',
+            description: `Connector-specific target (Rybbit site id). Optional.`,
+        },
+        status: {
+            type: 'Enum',
+            isRequired: true,
+        },
+        last_health_at: {
+            type: 'string',
+            isNullable: true,
+            format: 'date-time',
+        },
+        has_credentials: {
+            type: 'boolean',
+            isRequired: true,
+        },
+        created_at: {
+            type: 'string',
+            format: 'date-time',
+        },
+    },
+} as const;