[API] Support Webhook Callbacks

[fentz26]

Problem

No async notification mechanism:

• Clients must poll for status changes
• No real-time updates
• Inefficient resource usage

Proposed Solution

Webhook Registration

type Webhook struct {
    ID        string   `json:"id"`
    URL       string   `json:"url"`
    Events    []string `json:"events"` // task.created, task.completed, run.failed
    Secret    string   `json:"-"`      // for HMAC signature
    Active    bool     `json:"active"`
    CreatedAt time.Time `json:"created_at"`
}

// Events
const (
    EventTaskCreated   = "task.created"
    EventTaskCompleted = "task.completed"
    EventTaskFailed    = "task.failed"
    EventRunStarted    = "run.started"
    EventRunCompleted  = "run.completed"
)

Webhook Delivery

type WebhookPayload struct {
    ID        string      `json:"id"`
    Event     string      `json:"event"`
    Timestamp time.Time   `json:"timestamp"`
    Data      interface{} `json:"data"`
}

// HMAC signature
signature := hmac.New(sha256.New, []byte(webhook.Secret))
signature.Write(payloadBytes)
sig := hex.EncodeToString(signature.Sum(nil))
req.Header.Set("X-Neona-Signature", sig)

Acceptance Criteria

• Webhook CRUD endpoints
• Event subscription filtering
• HMAC signature verification
• Retry with exponential backoff
• Webhook delivery logs
• Test endpoint capability

References

• Parent Epic: 🔌 Epic: API Improvements #72