Add durable webhook delivery foundation

[peg]

Summary

• define a privacy-bounded, versioned queue message contract for durable webhook delivery
• document production/staging queue topology, retry policy, activation gates, and self-hosting constraints
• test that callback bodies, authorization values, raw webhook URLs, device secrets, and unrecognized nested SDK hints cannot enter messages
• identify destinations only by a normalized SHA-256 digest and reject non-HTTPS or credential-bearing URLs

Rollout status

This PR does not change runtime webhook behavior. It adds no Worker import, queue binding, producer, or consumer. Direct delivery remains active.

The following empty Cloudflare resources have been created for the managed deployment:

• snare-webhook-delivery
• snare-webhook-delivery-dlq
• snare-webhook-delivery-staging
• snare-webhook-delivery-staging-dlq

Keeping queue bindings out of this foundation PR avoids imposing a new Cloudflare resource requirement on public self-hosters. A follow-up activation PR will add producer and consumer behavior together, with an optional/self-host-compatible configuration.

Before activation, the GitHub environment tokens for snare-worker-staging and snare-worker-production must receive account-scoped Queues Edit.

Verification

• npm test: 57/57 passed
• npm audit --audit-level=high: 0 vulnerabilities
• npm run cf:check: passed; production bundle has no queue binding
• npm run cf:check:staging: passed; staging bundle has no queue binding
• go test ./... -v -race -count=1: passed (optional local canary clients unavailable locally; CI installs/verifies them)
• go vet ./...: passed
• go build ./...: passed
• govulncheck ./...: 0 called vulnerabilities
• git diff --check: passed