[Backend] Add outgoing webhook system for credential issuance and verification events

[Penielka]

Description

Third-party systems (LMS platforms, employer portals, institutional systems) need to be notified when credentials are issued, verified, or revoked. Implement an outgoing webhook system: subscribers register a URL + secret, and the system delivers signed webhook payloads with retry logic.

Definition of Done

• Webhook subscription management CRUD (register, update, delete, list)
• Webhook payload signing with HMAC-SHA256 for verification
• Event types: credential.issued, credential.verified, credential.revoked, enrollment.created
• Retry with exponential backoff (3 retries over ~15 minutes)
• Webhook delivery logs stored and queryable
• Configurable per-subscription event filter
• Admin dashboard to view subscription status and delivery history
• Dead-letter queue for permanently failed deliveries

Acceptance Criteria

1. Register webhook URL via API → receives events on credential issuance
2. Payload signature verifiable using shared secret
3. Failed deliveries retried 3 times, then marked as failed
4. Admin can view delivery history and manually retry
5. System handles 100+ concurrent subscriptions without performance degradation

Files to Modify

• New file: backend/src/services/webhookService.ts — webhook dispatch logic
• New file: backend/src/routes/webhooks.ts — admin CRUD routes
• New file: backend/src/models/WebhookSubscription.ts — Mongoose model
• New file: backend/src/models/WebhookDelivery.ts — delivery log model
• backend/src/utils/schemas.ts — add webhook validation schemas
• backend/src/index.ts — register routes
• backend/src/events/transactionEvents.js — emit webhook events on credential ops

[Kaycee276]

Hi maintainer, can i work on this issue?

[gloskull]

Hello, I have 4 years of experience delivering solutions for projects like this, covering backend, frontend, and smart contract development. After carefully reviewing your requirements, I have a clear understanding of the task and am confident in my ability to deliver a clean, efficient, and thoroughly tested solution on time. I prioritize code quality, maintainability, and industry best practices throughout the development process.
My PR will be submitted in under 10hours.

[clintjeff2]

Hello, I have 6 years of experience working on tasks like this and handling similar challenges across backend, frontend, and smart-contract development. I have carefully read and fully understood the task requirements, and I am confident I can deliver a clean, efficient, and well-tested solution promptly. I always ensure high-quality implementation, maintainability, and adherence to best practices.

Pull request in 5 hours.