feat(forge): push webhook flags drift at the moment the repo moves (#2691)

Second adapter consumer. POST /api/webhooks/forge validates Gitea's
X-Gitea-Signature (HMAC-SHA256, constant-time; no secret configured =
the endpoint 404s out of existence), extracts changed/removed paths,
and flags matched snippets by writing verification.invalidated_by
{commit_sha, at, path, removed} — the existing attention vocabulary
extended, not a new flag: needs_attention includes it, both filter
dialects (Python + jsonpath SQL) include it in 'attention' and exclude
it from 'ok', and recording ANY fresh verdict clears it by construction
because compose_verification builds a new dict. Unverified snippets are
skipped (already in their own bucket); replayed deliveries at the same
head commit are no-ops; processing failures return 200 with a WARNING +
AppLog canary so the forge never marks deliveries failed and operators
never disable the hook over a transient (#2663's lesson).

Matching goes through repo BINDINGS: recorded location repos are
free-form names ('Scribe') that cannot address a forge, so a snippet
reaches its forge repo through its project's binding — which also fixes
step 5's pull-time resolution for every real record via the same
fallback. O(bindings + snippets-in-project + changed files).

Settings: webhook secret beside the forge config (masked, sentinel-
skipped, Docker-secret env channel, endpoint documented in the UI).
Tests: signature gate, payload parsing, path semantics, both filter
dialects extended in the drift-check guard file, and real-Postgres
end-to-end (flag lands, attention lists it, replay quiet, re-verify
clears, unbound repo untouched).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/scribe/routes/admin.py

@@ -172,13 +172,21 @@ _TOKEN_MASK = "********"
 @admin_bp.route("/forge", methods=["GET"])
 @admin_required
 async def get_forge_settings():
+    from scribe.config import Config
+    from scribe.routes.webhooks import FORGE_WEBHOOK_SECRET_KEY
+
     cfg = await forge_config()
+    webhook_secret = (
+        await get_admin_setting(FORGE_WEBHOOK_SECRET_KEY, "")
+        or Config.FORGE_WEBHOOK_SECRET
+    )
     return jsonify({
         "kind": cfg["kind"],
         "base_url": cfg["base_url"],
-        # The token itself never leaves the server — the smtp_password
-        # convention: masked when set, empty when not.
+        # Secrets never leave the server — the smtp_password convention:
+        # masked when set, empty when not.
         "token": _TOKEN_MASK if cfg["token"] else "",
+        "webhook_secret": _TOKEN_MASK if webhook_secret else "",
         "configured": bool(await get_forge()),
         "kinds": list(FORGE_KINDS),
     })
@@ -204,6 +212,11 @@ async def update_forge_settings():
     # showed it, and storing the mask would silently break the integration.
     if token is not None and token != _TOKEN_MASK:
         await set_admin_setting(FORGE_TOKEN_KEY, str(token))
+    from scribe.routes.webhooks import FORGE_WEBHOOK_SECRET_KEY
+
+    webhook_secret = data.get("webhook_secret")
+    if webhook_secret is not None and webhook_secret != _TOKEN_MASK:
+        await set_admin_setting(FORGE_WEBHOOK_SECRET_KEY, str(webhook_secret))
     # The token is deliberately absent from the audit detail.
     await log_audit(
         "forge_config", user_id=uid, username=g.user.username,