Repair webhook inventory and delivery monitoring

[giscebot]

Summary

Repair the webhook monitoring dashboard introduced in #229 so it works as an operational inventory rather than a set of disconnected summary views.

• use real cursor-based incremental loading for both Hooks and Deliveries with accumulated pages and IntersectionObserver
• persist the sanitized configuration received in signed GitHub ping deliveries: target, active state, subscribed events, content type, SSL verification, destination/API URLs, and GitHub timestamps
• update each hook with its latest delivery ID, event/action, repository, result, and activity timestamp
• expose an admin-only hook detail endpoint and shareable /webhooks/hooks/{id} page
• show the sending hook on every delivery and link it to the hook detail
• derive the direct GitHub administration URL for organization and repository hooks
• add server-side delivery filters for hook, event, repository, and result
• explain legacy rows without X-GitHub-Hook-ID instead of presenting them as attributable

API and migration

• GET /api/webhooks/github/hooks?limit=&cursor= is now cursor-paginated
• GET /api/webhooks/github/hooks/{hook_id} returns sanitized configuration, retained-delivery statistics, and recent deliveries
• GET /api/webhooks/github/deliveries joins known hook identity and accepts indexed dimensions as filters
• the SQLite migration is additive and keeps existing receipts intact; no raw webhook payload or secret is stored

Tests

• backend coverage verifies ping configuration persistence, activity updates, admin URLs, hook detail, hook pagination, delivery filtering/association, auth, and existing-schema migration
• frontend coverage verifies hook navigation/detail, delivery-to-hook association, the scroll sentinel, and an integration flow that fetches and accumulates two cursor pages through React Query

Validation

• pytest -q — 388 passed
• npm test -- --run — 60 passed
• npm run build — passed
• migration against a copy of the production SQLite database — 771 receipts preserved, PRAGMA integrity_check = ok, no foreign-key violations

This repairs the concrete inventory, traceability, detail, and loading defects from #229. The broader shadow-to-canary coverage gate and exception analysis remain tracked in #191 rather than being falsely presented as complete here.

Requested by: @ecarreras

Related to #191