feat: webhook event system with signed delivery

[crftsmnd]

Closes #77

Added webhook support so integrations can subscribe to FinMind events and get notified.

What it does:

• CRUD for webhook endpoints (/webhooks)
• HMAC-SHA256 signed payloads (X-FinMind-Signature header)
• Retry with exponential backoff (5 attempts max, 1s/2s/4s/8s/16s)
• Test endpoint to verify delivery (POST /webhooks/:id/test)
• Event log for debugging (GET /webhooks/events)
• Per-user isolation (users can only see/manage their own endpoints)

New models: webhook_endpoints, webhook_events tables added to schema.sql.

Tests: 9 tests covering CRUD, isolation, signature verification, test endpoint. All passing. Lint clean.

Note: dispatch_event() is called from background thread. The caller hooks into existing routes (expense create, bill pay, etc.) to fire events. Did not wire those in yet since the scope was just the delivery system itself. Happy to add event triggers in a follow-up if needed.