feat(integrations): record deployments from GitLab and Flux webhooks

[TartanLeGrand]

What

Record deployments in Tracker from what the deployment tooling already emits, without any extra CI job:

• POST /api/v1alpha1/integrations/gitlab/webhook: GitLab "Deployment events" (signing token with Standard Webhooks signatures, or the legacy secret token).
• POST /api/v1alpha1/integrations/flux/webhook: Flux notification-controller generic-hmac provider (Kustomization and HelmRelease).
• One Tracker deployment event per deployment, created on start and updated afterwards; retries, replays and out of order deliveries have no effect (new integration_deployments collection, 90 day TTL).
• The deployment lock is taken like a manual deployment; a service locked by someone else never makes the webhook fail, the event carries a changelog comment instead.
• Event and lock RPCs now delegate to unauthorized cores. Behaviour change: an event that takes a lock counts one decision in tracker_auth_requests_total instead of three. A negative event duration from clock skew is now clamped to 0. The "lock not found for event to update" warning log no longer exists on the RPC path.
• New metric tracker_integration_webhooks_total{source,result}.

Configuration

Routes exist only when their source is configured: INTEGRATION_GITLAB_SIGNING_TOKEN (or INTEGRATION_GITLAB_SECRET_TOKEN), INTEGRATION_FLUX_HMAC_KEY, INTEGRATION_WEBHOOK_TOLERANCE (default 5m), INTEGRATION_ENVIRONMENTS (default production=production,staging=preproduction). See docs/INTEGRATIONS.md and docs/CONFIGURATION.md.

Checks

• go test ./... with MongoDB 7: green, 392 tests passed across 15 packages.
• go test -race ./internal/... ./server/...: green, no data race.
• go test ./internal/integrations/ -cover: green, 98.8% statement coverage.
• golangci-lint run: 2 issues (baseline 2, pre-existing in untracked pkg/flatted/flatted.go, unrelated to this change).
• gosec -exclude=G103,G115 -exclude-generated ./...: 0 issues (baseline 0).
• govulncheck ./...: no vulnerability in called code; one pre-existing module-level advisory (golang.org/x/crypto openpgp, GO-2026-5932) that this branch does not call and does not introduce (go.mod/go.sum untouched).
• End to end against tracker serv: GitLab running then success gives one event and a lock taken then released, replay answers 202 duplicate, an invalid signature answers 401 with nothing written, a review/* environment answers 202 ignored, Flux Progressing then ReconciliationSucceeded in the same second gives one successful event, a bad Flux signature answers 401, both routes answer 404 without configuration, no secret in the logs, tracker_integration_webhooks_total exposed on :8081/metrics with source/result labels.

Notes for reviewers

• The event/lock core refactor keeps RPC behaviour, with two observable changes: a CreateEvent that takes a lock now counts one authorization decision instead of three in tracker_auth_requests_total, and a negative event duration caused by clock skew is now clamped to 0.
• The "lock not found for event to update" warning log no longer exists on the RPC path.
• The pre-existing log.Fatalln in the event and lock store Create is untouched (out of scope).
• The GitLab correlation key's host now comes from project.web_url only (the signed payload), not X-Gitlab-Instance: that header is not part of the Standard Webhooks signed content, so keying on it let a captured, still-valid signed delivery be replayed within the tolerance window with a different instance header to mint a new key and bypass the replay protection. X-Gitlab-Instance is still logged (truncated), just no longer trusted for correlation.
• To confirm on a GitLab instance: whether "Resend request" re-signs with a fresh webhook-timestamp. GitLab documents only that the Idempotency-Key is kept. If the original timestamp is reused, a resend older than INTEGRATION_WEBHOOK_TOLERANCE is refused with 401 in signing-token mode, and the recovery note in docs/INTEGRATIONS.md needs adjusting.
• Test gap: the processor path "event update fails for a storage reason other than not found, then Revert, then 500" is covered only at the store level (Revert); covering it in the processor needs an injectable event store. Follow-up.

Out of scope

• Pipeline and job events (drift), merge request enrichment, GitLab API polling, GitHub deployment_status.
• Helm chart wiring of the new secrets (tracked separately).
• UI changes.
• EventStoreClient.Create and LockStoreClient.Create still stop the process on an insert error (existing behaviour).
• createLock checks then inserts without a unique index (pre-existing); two concurrent deployments of the same service can both hold a lock; follow-up issue.

Closes #208