[woahwhattheheck]

Summary

Lands the production-backend half of the signed webhook work tracked in Stellar-Analysis/frontend#336 / frontend PR #405.

• persists the stable event envelope and idempotency identity across retries/restarts
• atomically reserves due deliveries with an expiring reservation token
• records retry scheduling/failure metadata and terminal failure state
• keeps raw-body HMAC inputs stable, rejects redirects, and bounds HTTP requests
• exposes owner-authenticated delivery status without payloads or secrets
• returns the signing secret only at creation with Cache-Control: no-store
• adds the backend migration plus focused durable-delivery/auth regressions

Validation provenance

This branch is an exact materialization of the 15-file backend integration manifest carried by frontend PR #405, against backend base 965e916227cf9173cf6ad254a6971429060c1d19. Every postimage Git blob SHA matches that manifest.

Retained native evidence in that packet records:

cargo test --locked --test webhook_delivery_regression_tests --test webhook_event_service_tests

26 passed, 0 failed, with changed-Rust formatting and baseline apply checks passed. The full unrelated library unit suite is not claimed green; the integration packet documents its pre-existing compilation failures separately. This publication pass did not rerun the retained native test command.

Companion: Stellar-Analysis/frontend#405

Closes Stellar-Analysis/frontend#336