Webhooks: post each new incoming message (closes #7)

Each message a contact sends in a direct chat is posted to each webhook registered on that chat: `POST`, `Content-Type: application/json`, body `{"chat_id":N,"message":{...}}` with the same record the messages endpoint returns. The event handler only queues the message; four goroutines post it, one attempt each with a 10-second timeout and no retries, and with 100 already waiting a message is dropped and logged, so a slow webhook never delays the bot's replies. Posting stops last, after the chat client.

Disclosures: redirects are not followed; a logged failure can name the webhook's host but never its path, query or credentials; posts still in flight at shutdown are abandoned and logged.

Model: opus-5-5

internal/api/api.go

@@ -1,6 +1,7 @@
 // Package api is the bot's HTTP API, through which another program
 // reads the bot's chats, sends messages in them and registers webhooks
-// on them.
+// on them. Deliveries posts to those webhooks each message a contact
+// sends.
 //
 // Every request must carry the credential, as "Authorization: Bearer
 // {credential}"; with no credential configured, every request is
@@ -9,6 +10,8 @@
 // Handlers call the chat client on the request's own goroutine. Doing
 // so from the chat client's event handler would wait forever, since
 // that goroutine also delivers the responses (see simplex.EventHandler).
+// For the same reason, the event handler hands messages to Deliveries
+// without waiting.
 package api
 
 import (