Add optional inbound webhook signature verification (closes #67)

A receiver URL was a bare v4 UUID and nothing else: anyone who learned
it could store events and, because inbound headers are forwarded to
targets almost verbatim, choose what the downstream service received.

Entrypoints gain an optional scheme/secret pair. GitHub's
X-Hub-Signature-256 (HMAC-SHA256 hex over the raw body) and GitLab's
X-Gitlab-Token (plain shared token) are supported; both compare with
hmac.Equal. With nothing configured an entrypoint behaves exactly as
before, which is also where every pre-existing row lands after
AutoMigrate adds the columns.

Verification runs after the capped body read and before the first
write, so a rejected request leaves no event row, no delivery row and
no delivery task. A configuration the receiver cannot apply — unknown
scheme, or one half of the pair missing — is refused with a 500 rather
than falling back to unverified.

The secret is credential-bearing and is stored in the clear because
HMAC needs the key itself. It is excluded from JSON, kept out of
templates by a new handlers.EntrypointView projection, and absent from
every log line including the rejection path. The UI sets and rotates
it through one form that never renders the stored value.

Under the GitLab scheme the signature header is the secret rather than
a digest over the request, so an accepted request's headers are cloned
and the configured scheme's credential header dropped before they are
serialized onto the event. Stored headers are persisted verbatim in
the per-webhook database and replayed onto every outbound delivery, so
keeping the token would put it in every backup and hand every target
operator the means to forge signed requests to the entrypoint it
authenticates. Stripping sits once above the first write rather than
at each egress, and is driven by the scheme's own description with
stripping as the default: a scheme added later is covered unless it
declares its header a digest, as GitHub's HMAC over the body does.

An entrypoint holding one half of the pair now renders as
misconfigured rather than as unverified, and the scheme selector
follows the stored scheme so such a row no longer marks two options
selected.

templates/source_detail.html

@@ -48,7 +48,7 @@
 
             <div class="divide-y divide-gray-100">
                 {{range .Entrypoints}}
-                <div class="p-4">
+                <div class="p-4" x-data="{ showSecret: false }">
                     <div class="flex items-center justify-between mb-1">
                         <span class="text-sm font-medium text-gray-900">{{if .Description}}{{.Description}}{{else}}Entrypoint{{end}}</span>
                         <div class="flex items-center gap-2">
@@ -75,6 +75,38 @@
                              script the URL above stays selectable. -->
                         <button type="button" hidden data-copy-target="entrypoint-url-{{.ID}}" class="text-xs text-gray-500 hover:text-primary-600">Copy</button>
                     </div>
+                    <div class="flex items-center gap-2 mt-2">
+                        <span class="text-xs text-gray-500">
+                            Signature: {{.SchemeLabel}}{{if .SchemeHeader}} ({{.SchemeHeader}}){{end}}
+                        </span>
+                        <button type="button" @click="showSecret = !showSecret" class="text-xs text-gray-500 hover:text-primary-600">
+                            {{if .Configured}}Rotate{{else}}Configure{{end}}
+                        </button>
+                    </div>
+                    <!-- The stored secret is never sent to the browser: the
+                         form takes a new one every time, so setting and
+                         rotating are the same submission. -->
+                    <div x-show="showSecret" x-cloak class="mt-2">
+                        <form method="POST" action="/source/{{$.Webhook.ID}}/entrypoints/{{.ID}}/secret" class="flex gap-2">
+                            <input type="hidden" name="csrf_token" value="{{$.CSRFToken}}">
+                            <select name="signature_scheme" class="input text-sm w-28">
+                                <!-- Selection follows the stored scheme, not
+                                     whether the pair is complete: a row with a
+                                     scheme and no secret would otherwise mark
+                                     both this option and its own selected. -->
+                                <option value="" {{if not .Scheme}}selected{{end}}>None</option>
+                                {{$current := .Scheme}}
+                                {{range $.SignatureSchemes}}
+                                <option value="{{.Scheme}}" {{if eq .Scheme $current}}selected{{end}}>{{.Label}}</option>
+                                {{end}}
+                            </select>
+                            <input type="password" name="secret" autocomplete="new-password" placeholder="Shared secret" class="input text-sm flex-1">
+                            <button type="submit" class="btn-primary text-sm">Save</button>
+                        </form>
+                        <p class="text-xs text-gray-500 mt-1">
+                            Enter the same secret you configured at the sender. Selecting None removes verification.
+                        </p>
+                    </div>
                 </div>
                 {{else}}
                 <div class="p-4 text-sm text-gray-500">No entrypoints configured.</div>