Harden webhook handling and user resolution

[daiv-agent]

Hardens webhook-driven identity resolution and callback handling across GitLab and GitHub. Webhook validation now fails closed when no secret is configured, callbacks reject duplicate deliveries via DAIV's existing eyes reaction, and user resolution trusts the verified provider+uid social account over unverified webhook-claimed username/email.

Key Changes:

• resolve_user (daiv/accounts/utils.py) now resolves the verified provider+uid SocialAccount first; username/email matches are only fallbacks when no social account exists, preventing a platform user sharing a victim's username/email from being misattributed to the victim.
• GitLab and GitHub webhook validation (validate_gitlab_webhook / validate_github_webhook) now fail closed: an unconfigured secret rejects the payload (logged at ERROR) instead of passing, and check_api_keys (daiv/codebase/checks.py) surfaces a missing webhook secret for the active platform as a deployment error.
• Webhook callbacks are now idempotent: GitHub IssueCommentCallback and GitLab NoteCallback reject replays/duplicate deliveries when DAIV has already reacted with the eyes emoji on that specific comment/note.
• RepoClient.has_issue_reaction gained a note_id parameter (checks the comment/note's reactions instead of the issue), and a new has_merge_request_note_reaction abstract method was added — implemented for GitHub (delegates to the issue-comment API) and GitLab (award emoji on the MR note), with SWE stubs raising NotImplementedError.
• New WEBHOOK_SSL_VERIFY setting (default True) in daiv/codebase/conf.py; the setup_webhooks cron task now drives disable_ssl_verification from it instead of settings.DEBUG, so a debug-shaped deployment no longer silently downgrades secure webhooks.
• Tests updated/added covering the new resolution order, fail-closed validation, replay rejection, note-scoped reaction checks, and the SSL-verify setting.

---

⚠️ DAIV can make mistakes. Please review the changes and merge the MR if everything looks good.
🔗 Generated by DAIV — view sessions

---

💡 Instructions for the reviewer:

• 💬 Just leave comments/reviews mentioning @daiv-agent to get DAIV to address them for you.