feat(webhooks): subscription CRUD + HMAC-signed delivery client

Introduces the webhook egress foundation — a new WebhookSubscription
table, admin-gated CRUD under /api/v1/webhooks, and the shared
delivery client that both the test-ping route and the upcoming worker
will use. No worker yet; this commit is API + model + client only.

Simple-mode enum (AttackerDetail / DeckyStatus / SystemStatus) expands
to bus-topic patterns at the router layer; storage is always the raw
pattern list. Advanced mode lets admins supply raw NATS-style patterns
directly. Filter-at-subscribe: the worker (next commit) will subscribe
to the union of patterns across enabled subscriptions.

Delivery client handles HMAC-SHA256 signing (X-DECNET-Signature),
retry on 429/5xx/network errors with jittered backoff, no-retry on
4xx. Secrets never leave the server on GET/LIST — only the create
response carries the secret for copy-out.

CRUD routes publish WEBHOOK_SUBSCRIPTIONS_CHANGED on the bus after
every mutation so the (future) worker can hot-reload.

Opens DEBT-037 for the deferred items (circuit breaker, dead-letter,
batch delivery, payload templates, secret-at-rest).

decnet/web/db/repository.py

@@ -431,3 +431,40 @@ class BaseRepository(ABC):
 
     async def list_live_topology_ids(self) -> list[str]:
         return []
+
+    # --------------------------------------------------------- webhooks
+    # Webhook subscriptions — external SIEM / SOAR egress configuration.
+    # Default NotImplementedError keeps non-default backends honest; the
+    # SQLModel-backed SQLite and MySQL repos override everything below.
+
+    async def create_webhook_subscription(self, data: dict[str, Any]) -> None:
+        raise NotImplementedError
+
+    async def get_webhook_subscription(self, uuid: str) -> Optional[dict[str, Any]]:
+        raise NotImplementedError
+
+    async def get_webhook_subscription_by_name(
+        self, name: str
+    ) -> Optional[dict[str, Any]]:
+        raise NotImplementedError
+
+    async def list_webhook_subscriptions(
+        self, enabled_only: bool = False
+    ) -> list[dict[str, Any]]:
+        raise NotImplementedError
+
+    async def update_webhook_subscription(
+        self, uuid: str, patch: dict[str, Any]
+    ) -> bool:
+        raise NotImplementedError
+
+    async def delete_webhook_subscription(self, uuid: str) -> bool:
+        raise NotImplementedError
+
+    async def record_webhook_success(self, uuid: str, ts: Any) -> None:
+        raise NotImplementedError
+
+    async def record_webhook_failure(
+        self, uuid: str, ts: Any, error: str
+    ) -> None:
+        raise NotImplementedError