v4: deliver signed webhooks durably

[Phloraxx]

Scope

Twelfth stacked PayGate v4 implementation slice. Depends on PR #53.

Implements

• durable webhook delivery worker over the existing SQLite outbox
• HMAC-SHA256 signing over <timestamp>.<raw-body>
• PayGate-Event-Id, PayGate-Timestamp, and PayGate-Signature: v1=... headers
• HTTPS-only endpoint validation in production mode; no URL credentials/query/fragment
• no redirects and bounded HTTP timeout/body drain
• single in-process sender plus next_attempt_at delivery lease so restart/interruption cannot strand rows
• at-least-once delivery semantics; event ID remains the consumer dedupe key
• bounded exponential retry for network errors, 408, 425, 429, and 5xx
• permanent 4xx such as 404 exhaust immediately instead of generating repeated useless retries
• max-attempt exhaustion with last HTTP status/error retained for Activity
• explicit one-event manual retry that resets only the selected retry/exhausted delivery
• no network I/O inside SQLite write transactions

Tests

Covers signature/header/body identity, successful delivery persistence, 500 retry/backoff then success, 404 immediate exhaustion, explicit manual retry, interrupted-claim lease recovery, and webhook configuration validation. Full internal/v4/... unit tests, race tests, vet and diff checks pass locally.

Safety

No production runtime registration or endpoint configuration cutover yet. Existing v3 webhook worker is untouched.