feat: UX improvements, webhooks, invite management

- Photo lightbox: ArrowLeft/Right/Escape keyboard navigation
- Growth chart: persistent WHO percentile legend (not hover-only)
- Sleep stats: configurable window selector (18h/19h/20h/21h)
- Quick-add FAB: now visible on desktop (bottom-right corner)
- Invite code reset button in settings (non-admin, PARENT role only)
- Pending email invites: tracked per-token with 7-day expiry, revocable
  from settings UI; new /auth/invite/t/[token] accept page
- Webhooks: Prisma model, CRUD API, HMAC-SHA256 dispatcher wired into
  event.created / growth.created / doctor_note.created; settings UI
- Docker cron service: medication reminders every 15min, milk-expiry
  and daily-digest daily; secured with CRON_SECRET
- Photo uploads persist across redeploys via Docker named volume

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/lib/webhooks.ts

@@ -0,0 +1,42 @@
+import { createHmac, randomBytes } from "crypto";
+import { prisma } from "./prisma";
+
+export type WebhookEventType =
+  | "event.created"
+  | "growth.created"
+  | "doctor_note.created"
+  | "milestone.created"
+  | "medication.due";
+
+export function generateWebhookSecret(): string {
+  return randomBytes(32).toString("hex");
+}
+
+export async function dispatchWebhook(
+  familyId: string,
+  eventType: WebhookEventType,
+  payload: Record<string, unknown>
+): Promise<void> {
+  const hooks = await prisma.webhook.findMany({
+    where: { familyId, active: true, events: { has: eventType } },
+  });
+  if (hooks.length === 0) return;
+
+  const body = JSON.stringify({ event: eventType, ...payload });
+
+  await Promise.allSettled(
+    hooks.map(async (hook) => {
+      const sig = createHmac("sha256", hook.secret).update(body).digest("hex");
+      await fetch(hook.url, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          "X-Grow-Signature": `sha256=${sig}`,
+          "X-Grow-Event": eventType,
+        },
+        body,
+        signal: AbortSignal.timeout(10_000),
+      });
+    })
+  );
+}