feat(webhooks): outbound webhooks with HMAC-SHA256 signing and API key auth

Webhook registration/management. HMAC-signed delivery with retry.
Events: recipe.created/updated, comment.created, follower.new.
REST API key creation for programmatic access.

apps/web/app/api/v1/webhooks/[id]/redeliver/route.ts

@@ -0,0 +1,41 @@
+import { NextRequest, NextResponse } from "next/server";
+import { z } from "zod";
+import { db, webhooks, webhookDeliveries, eq, and } from "@epicure/db";
+import { requireSession } from "@/lib/api-auth";
+import { dispatchWebhook, type WebhookEvent } from "@/lib/webhooks";
+
+const Schema = z.object({ deliveryId: z.string().uuid() });
+
+type Params = { params: Promise<{ id: string }> };
+
+export async function POST(req: NextRequest, { params }: Params) {
+  const { session, response } = await requireSession();
+  if (response) return response;
+
+  const { id } = await params;
+
+  const hook = await db.query.webhooks.findFirst({
+    where: and(eq(webhooks.id, id), eq(webhooks.userId, session!.user.id)),
+    columns: { id: true },
+  });
+  if (!hook) return NextResponse.json({ error: "Not found" }, { status: 404 });
+
+  const body = Schema.safeParse(await req.json());
+  if (!body.success) return NextResponse.json({ error: body.error.flatten() }, { status: 400 });
+
+  const delivery = await db.query.webhookDeliveries.findFirst({
+    where: and(
+      eq(webhookDeliveries.id, body.data.deliveryId),
+      eq(webhookDeliveries.webhookId, id)
+    ),
+  });
+  if (!delivery) return NextResponse.json({ error: "Delivery not found" }, { status: 404 });
+
+  void dispatchWebhook(
+    session!.user.id,
+    delivery.event as WebhookEvent,
+    (delivery.payload ?? {}) as object
+  );
+
+  return NextResponse.json({ ok: true });
+}