feat(forge): push webhook flags drift at the moment the repo moves (#2691)

Second adapter consumer. POST /api/webhooks/forge validates Gitea's
X-Gitea-Signature (HMAC-SHA256, constant-time; no secret configured =
the endpoint 404s out of existence), extracts changed/removed paths,
and flags matched snippets by writing verification.invalidated_by
{commit_sha, at, path, removed} — the existing attention vocabulary
extended, not a new flag: needs_attention includes it, both filter
dialects (Python + jsonpath SQL) include it in 'attention' and exclude
it from 'ok', and recording ANY fresh verdict clears it by construction
because compose_verification builds a new dict. Unverified snippets are
skipped (already in their own bucket); replayed deliveries at the same
head commit are no-ops; processing failures return 200 with a WARNING +
AppLog canary so the forge never marks deliveries failed and operators
never disable the hook over a transient (#2663's lesson).

Matching goes through repo BINDINGS: recorded location repos are
free-form names ('Scribe') that cannot address a forge, so a snippet
reaches its forge repo through its project's binding — which also fixes
step 5's pull-time resolution for every real record via the same
fallback. O(bindings + snippets-in-project + changed files).

Settings: webhook secret beside the forge config (masked, sentinel-
skipped, Docker-secret env channel, endpoint documented in the UI).
Tests: signature gate, payload parsing, path semantics, both filter
dialects extended in the drift-check guard file, and real-Postgres
end-to-end (flag lands, attention lists it, replay quiet, re-verify
clears, unbound repo untouched).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/scribe/services/repo_bindings.py

@@ -100,6 +100,41 @@ async def list_bindings(user_id: int) -> list[RepoBinding]:
         return list(rows.scalars().all())
 
 
+async def keys_for_project(user_id: int, project_id: int) -> list[str]:
+    """Every repo key bound to a project — the snippet→forge join (#2691).
+
+    Recorded snippet locations carry free-form repo names ("Scribe"), which
+    can't address a forge API. The project's binding is the identity that can:
+    a snippet reaches its forge repo through the project it belongs to.
+    """
+    async with async_session() as session:
+        rows = await session.execute(
+            select(RepoBinding.repo_key).where(
+                RepoBinding.user_id == user_id,
+                RepoBinding.project_id == project_id,
+            )
+        )
+        return [k for (k,) in rows.all()]
+
+
+async def bindings_for_key(raw_repo: str) -> list[RepoBinding]:
+    """All bindings (ANY user) for a repo key — the webhook's entry point.
+
+    A push webhook carries no Scribe caller, only the repository it happened
+    to; the flag it writes is about each record's truth, so every user who
+    bound the repo gets their project's snippets considered — each write still
+    lands as that record's owner.
+    """
+    key = normalize_repo_key(raw_repo)
+    if not key:
+        return []
+    async with async_session() as session:
+        rows = await session.execute(
+            select(RepoBinding).where(RepoBinding.repo_key == key)
+        )
+        return list(rows.scalars().all())
+
+
 async def delete_binding(user_id: int, raw_repo: str) -> bool:
     """Remove a repo's binding. Returns True if a row was deleted."""
     key = normalize_repo_key(raw_repo)