security: add HMAC signature verification to webhook ingest

Webhook ingest endpoint was completely unauthenticated. Add an optional
`secret` field to BoardWebhook. When configured, inbound requests must
include a valid HMAC-SHA256 signature in X-Hub-Signature-256 or
X-Webhook-Signature headers. Uses hmac.compare_digest for timing safety.
Includes migration to add the secret column.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

backend/app/schemas/board_webhooks.py

@@ -18,6 +18,7 @@ class BoardWebhookCreate(SQLModel):
     description: NonEmptyStr
     enabled: bool = True
     agent_id: UUID | None = None
+    secret: str | None = None
 
 
 class BoardWebhookUpdate(SQLModel):
@@ -26,6 +27,7 @@ class BoardWebhookUpdate(SQLModel):
     description: NonEmptyStr | None = None
     enabled: bool | None = None
     agent_id: UUID | None = None
+    secret: str | None = None
 
 
 class BoardWebhookRead(SQLModel):
@@ -36,6 +38,7 @@ class BoardWebhookRead(SQLModel):
     agent_id: UUID | None = None
     description: str
     enabled: bool
+    has_secret: bool = False
     endpoint_path: str
     endpoint_url: str | None = None
     created_at: datetime