feat(webhooks): outbound webhooks with HMAC-SHA256 signing and API key auth

Webhook registration/management. HMAC-signed delivery with retry.
Events: recipe.created/updated, comment.created, follower.new.
REST API key creation for programmatic access.

apps/web/app/api/v1/api-keys/route.ts

@@ -0,0 +1,58 @@
+import { NextRequest, NextResponse } from "next/server";
+import crypto from "node:crypto";
+import { z } from "zod";
+import { db, apiKeys, eq } from "@epicure/db";
+import { requireSession } from "@/lib/api-auth";
+
+const CreateApiKeyBody = z.object({
+  name: z.string().min(1).max(100),
+});
+
+export async function GET() {
+  const { session, response } = await requireSession();
+  if (response) return response;
+
+  const rows = await db
+    .select({
+      id: apiKeys.id,
+      name: apiKeys.name,
+      lastUsedAt: apiKeys.lastUsedAt,
+      createdAt: apiKeys.createdAt,
+    })
+    .from(apiKeys)
+    .where(eq(apiKeys.userId, session!.user.id));
+
+  return NextResponse.json(rows);
+}
+
+export async function POST(req: NextRequest) {
+  const { session, response } = await requireSession();
+  if (response) return response;
+
+  const body = await req.json() as unknown;
+  const parsed = CreateApiKeyBody.safeParse(body);
+  if (!parsed.success) {
+    return NextResponse.json(
+      { error: "Validation error", issues: parsed.error.issues },
+      { status: 400 }
+    );
+  }
+
+  const rawKey = "ek_" + crypto.randomBytes(32).toString("hex");
+  const keyHash = crypto.createHash("sha256").update(rawKey).digest("hex");
+  const id = crypto.randomUUID();
+  const now = new Date();
+
+  await db.insert(apiKeys).values({
+    id,
+    userId: session!.user.id,
+    name: parsed.data.name,
+    keyHash,
+    createdAt: now,
+  });
+
+  return NextResponse.json(
+    { id, name: parsed.data.name, key: rawKey, createdAt: now.toISOString() },
+    { status: 201 }
+  );
+}