Webhooks: endpoint settings, Deliveries sharing line, and docs for the webhooks CoderHelm sends - #223

Summary

The dashboard and docs half of outbound webhooks (platform: CoderHelm/coderhelm-platform#306). Admins manage webhook endpoints in Settings, Webhooks, and https://docs.coderhelm.com/api/webhooks/ now leads with the webhooks CoderHelm sends, with a short section at the end on the webhooks it receives (one page). Deliveries also gets a one-line sharing status.

Changes

• Settings, Webhooks (/settings/webhooks/, admin, webhooks capability):
  • List: URL (wraps), description, events, On / Failing / Turned off, last delivery; failing endpoints explain the 5-day rule.
  • Add: https address with the API's field errors inline, description, events grouped by the catalog or all events, on/off; the secret is shown once with Copy.
  • Endpoint page: edit, turn on/off, delete; signing secret Reveal and Rotate (overlap 0 to 168 hours, default 24, new secret shown once); Send test event with the result and its fix; recent deliveries with every attempt, headers (signature removed), body preview and Resend; Replay a time range (only-failed option).
• Deliveries: webhook rows labelled with their host, Resend for them, a link to the endpoint; a one-line status at the top: failed deliveries shared with support (details only, or details and payload previews) or not shared, with Change linking to Settings, System, Hybrid (#hybrid-sharing). Left out on the hosted product.
• Docs:
  • /api/webhooks/: quick start, what a request looks like, verification in Node.js, Python, Go and Rust (constant-time compare, 5-minute timestamp tolerance, skip repeated webhook-ids) plus the Standard Webhooks libraries, the event catalog generated at build time from the platform's OpenAPI webhooks section (it can't drift), retries and the disable rule, Resend and replay, testing with a tunnel, security, a threat model, versioning, and the endpoint API.
  • The end of the same page, "Webhooks CoderHelm receives": GitHub App, Jira app, Jira webhooks, SNS alerts and CI test results, each with how CoderHelm verifies it and what it triggers. The page's live anchors (#github, #jira-app, #jira-webhook, #alerts-from-aws, #verifying-githubs-signature, #what-coderhelm-sends) still land on their sections. No new page, no redirects: the received webhooks' reference pages keep their published URLs, and the endpoint routes have their own "Webhook endpoints" reference group (pages recorded).
  • platform.lock.json pins the platform PR's head.

Verification

• Dashboard: tsc --noEmit "TypeScript: No errors found"; ui-lint "UI lint passed."; root eslint 0 errors; check:openapi matches; build exports /settings/webhooks. Full Playwright suite against the static build (port 3631): 1029 passed, 10 skipped, 0 failed. New e2e/webhooks.spec.ts covers list, create (field error, secret once), test event refused with its fix, reveal and rotate, resend, replay, turning a failing endpoint back on, delete and a member being blocked; e2e/deliveries.spec.ts covers the sharing line's three states and its absence. Screenshots at 1440 and 390 checked: no sideways scroll, long URLs wrap.
• Docs (pinned at the platform head, rebased on main): build OK ("15 webhook events", examples on coderhelm.example.com), pages:record nothing new, check:output 101 pages, check:links 4876 internal links none broken, typecheck clean, unit 86 pass, Playwright 82 passed (2 skipped), including the webhooks page sections, the threat model, the received-webhooks section at its old anchors, /api/incoming-webhooks/ answering 404, and the reference pages at their URLs. The Node, Python and Rust verification snippets were run against the Standard Webhooks test vector; the Go snippet was reviewed, not run.