Feat/87 Webhook System Review Notifier

[hanielee]

Summary

This PR adds an authenticated webhook system so review jobs can notify clients asynchronously when processing completes or fails. Clients can register a callback URL, and the app sends a signed POST payload with the final review state, removing the need to rely on polling for status updates.

Issue

Closes #87

Changes

• Added webhook registration, listing, and deletion endpoints in api/routes/webhooks.py and api/schemas/webhook.py.
• Added persistence for webhook registrations and delivery attempts through core/models/webhook.py, core/models/webhook_delivery.py, and alembic/versions/003_add_webhooks.py.
• Implemented signed delivery, retry/backoff handling, and delivery tracking in core/services/webhook_service.py.
• Wired webhook notifications into the review completion flow in core/services/review_service.py so both success and failure paths trigger outbound notifications.
• Added targeted unit coverage for registration, delivery, retry, and exhaustion behavior in tests/unit/test_webhook_service.py.

Testing

• Unit tests pass (pytest tests/unit/test_webhook_service.py -q)
• Integration tests pass (make test-integration)
• Linter passes (make lint)
• Type checker passes (make typecheck)
• New/updated tests cover the changes

Manual verification:

1. Start the app and create a review as usual.
2. Register a test webhook endpoint (for example, a local echo server or a temporary public URL).
3. Trigger a review and confirm the callback receives a signed POST with the completed or failed review payload.
4. Optionally simulate a temporary delivery failure to confirm the retry logic is exercised.

Notes for Reviewers

• The delivery flow signs outbound requests with HMAC-SHA256 and records each attempt for auditability.
• The current implementation focuses on webhook delivery reliability and retry behavior; further hardening around user-supplied callback URL validation can be addressed in a follow-up pass.