Add signed run completion webhooks

[iosayin]

Summary

Adds the outbound webhook path for organization run-completion events.

Closes #36

Implementation

• Register, list, and disable organization endpoints through session-authenticated admin routes. Generated signing secrets are AES-GCM encrypted at rest and shown only once.
• Enqueue run.completed and run.failed deliveries in the same transaction that settles each non-internal run.
• Deliver from a separate retryable worker using HMAC-SHA256 over the exact JSON body, stable delivery IDs, bounded payloads, and exponential backoff. Runs are not blocked by delivery failures.
• Restrict destinations to HTTPS hostnames, reject private/reserved DNS results, pin the resolved address for the TLS request, and do not follow redirects.
• Document endpoint management and raw-body signature verification.

Validation

• backend/test/webhooks.test.ts: 3 passed.
• Webhook signature and destination tests: 4 passed.
• backend/test/finalize.test.ts: 11 passed.
• Backend TypeScript check passed with bun-types explicitly included.
• docs-site build passed.

Known test environment failures

The full backend suite completed with 2,633 passing tests and 3 failures in backend/test/fleet-admission.test.ts; those tests fail in backend/src/fleet/reconciler.ts because lease.id is undefined. The isolated fleet-admission test file reproduces the failure.

The repository root bun run typecheck also stops at the existing frontend type configuration (TS2688 for bun); direct frontend and backend TypeScript checks pass when both bun and bun-types are included.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}