feat: add authenticated webhook ingress

[dakdevs]

Summary

• add Better Auth email/password sessions with persistent PostgreSQL tables
• provision one tenant account per authenticated user
• add tenant-scoped hook creation, listing, and secret rotation APIs
• add catch-all webhook ingress that preserves exact bytes and commits before returning 202
• hash ingress secrets at rest and make rotation immediately revoke old URLs

Verification

• bun run lint
• bun run prettier:check
• bun run typecheck
• bun test (27 passing)
• bun run test:e2e
• bun run build
• bun run db:generate (no drift)

[dakdevs]

Superseded by #8, which is merged into main.