feat: add configurable signature_header for webhook HMAC verification

Not all webhook providers use X-Hub-Signature-256 or X-Webhook-Signature.
Add an optional signature_header field so users can specify which header
carries the HMAC signature. When set, that exact header is checked;
when unset, the existing auto-detect fallback is preserved. The custom
header is also excluded from stored/exposed payload headers.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

backend/app/models/board_webhooks.py

@@ -24,5 +24,6 @@ class BoardWebhook(QueryModel, table=True):
     description: str
     enabled: bool = Field(default=True, index=True)
     secret: str | None = Field(default=None)
+    signature_header: str | None = Field(default=None)
     created_at: datetime = Field(default_factory=utcnow)
     updated_at: datetime = Field(default_factory=utcnow)