Deploy main eacf1e7 to prod

Replaces #559, which conflicted.

Model: opus-5-5

internal/database/model_secrets_test.go

@@ -29,8 +29,10 @@ func marshalModel(t *testing.T, v any) string {
 // these tags the first handler that marshals a model serialises the
 // secret with it. Each field below is a live credential:
 //
-//   - Target.Config holds an incoming-webhook URL whose path segments
-//     are the bearer token.
+//   - Target.URL is an incoming-webhook URL whose path segments are
+//     the bearer token.
+//   - Target.Headers holds header values, routinely authorization
+//     tokens.
 //   - APIKey.Key is a bearer token outright.
 //   - Setting.Value holds the session encryption key.
 //   - User.Password holds the Argon2 hash, and was already tagged.
@@ -44,11 +46,21 @@ func TestModelsDoNotMarshalTheirSecrets(t *testing.T) {
 		model any
 	}{
 		{
-			name: "target config",
+			name: "target url",
 			model: database.Target{
-				Name:   keptField,
-				Type:   database.TargetTypeSlack,
-				Config: `{"webhookUrl":"https://h/s/` + marker + `"}`,
+				Name:        keptField,
+				Type:        database.TargetTypeSlack,
+				URL:         "https://h/s/" + marker,
+				MaxAttempts: 1,
+			},
+		},
+		{
+			name: "target headers",
+			model: database.Target{
+				Name:        keptField,
+				Type:        database.TargetTypeHTTP,
+				Headers:     map[string]string{"Authorization": marker},
+				MaxAttempts: 1,
 			},
 		},
 		{
@@ -86,10 +98,10 @@ func TestModelsDoNotMarshalTheirSecrets(t *testing.T) {
 	}
 }
 
-// TestWebhookMarshalsNoTargetConfig covers the nested case: a webhook
+// TestWebhookMarshalsNoTargetURL covers the nested case: a webhook
 // marshalled with its targets preloaded must not carry the credential
 // through the association either.
-func TestWebhookMarshalsNoTargetConfig(t *testing.T) {
+func TestWebhookMarshalsNoTargetURL(t *testing.T) {
 	t.Parallel()
 
 	const marker = "QQNESTEDMARKERQQ"
@@ -97,8 +109,9 @@ func TestWebhookMarshalsNoTargetConfig(t *testing.T) {
 	encoded := marshalModel(t, database.Webhook{
 		Name: keptField,
 		Targets: []database.Target{{
-			Name:   "slack",
-			Config: `{"webhookUrl":"https://h/s/` + marker + `"}`,
+			Name:        "slack",
+			URL:         "https://h/s/" + marker,
+			MaxAttempts: 1,
 		}},
 	})