fix: never drop webhooks and reconcile missed merge XP

[ionfwsrijan]

Fix: Never Drop Webhooks and Reconcile Missed Merge XP (#862)

Problem

GitHub does not auto-redeliver failed webhook deliveries. The webhook route returned 500 on a DB insert failure and threw on inngest.send failure, permanently losing business-critical events (merged-PR XP, claims). Rate limiting also used one bucket per install, so a burst of one event type could starve pull_request events on the same install.

Changes

• src/app/api/webhooks/github/route.ts
  • Unhandled event types (push, create, delete, star, ping, …) are acknowledged with a 2xx before rate limiting or persisting, so webhook_deliveries only grows with events the app consumes.
  • Rate-limit keys are split per install and event type (install:{id}:{event}), so one burst can't starve business-critical events.
  • A transient DB insert failure no longer returns 500 — it logs and continues with best-effort dispatch (downstream functions are idempotent).
  • An inngest.send failure no longer throws; the event is dead-lettered to failed_webhook_events and the route acks 2xx — a webhook is never dropped with a 5xx.
• src/inngest/functions/maintenance.ts
  • New reconcileMergedPrXp (daily): for closed PRs merged in the last 7 days on each installation's repos, re-awards merge XP via the idempotent handleMerge when no xp_events row exists — recovering lost merge XP.
  • New webhookDeliveriesCleanup (daily): prunes webhook_deliveries older than 30 days (GitHub redelivery is only ~3 days, so older rows are pure storage growth).
• src/inngest/functions/process-pr-event.ts: exports handleMerge/MergePrShape for reuse by the reconciler.

Impact

Signature-verified webhooks are never dropped with a 5xx; rate-limit misses are honest (429, rare per-event buckets); and lost merge XP from transient failures is recovered daily.

Closes #862

[vercel]

@ionfwsrijan is attempting to deploy a commit to the codersogs-3057's projects Team on Vercel.

A member of the Team first needs to authorize it.

[github-actions]

Hey @ionfwsrijan

You have 4 open PRs right now. The limit is 3 at a time.

Please get your existing PRs merged or closed before opening new ones:

• fix: fail closed when no shared cache is configured in production #866 - fix: fail closed when no shared cache is configured in production
• fix: bound issues-sweep cost with per-repo checkpoints and cooldown  #865 - fix: bound issues-sweep cost with per-repo checkpoints and cooldown
• fix: route sync PRs/calendar through Octokit install client #864 - fix: route sync PRs/calendar through Octokit install client

This PR will remain open but won't be reviewed until you're under the limit. See our Contributing Guidelines for details.

[ionfwsrijan]

@Soumya-codr @codersogs-code Please review this

[ionfwsrijan]

@jakharmonika364