feat: Webhook receiver endpoint + HMAC verification

[nexus-marbell]

Summary

Add a /api/github-webhook POST endpoint to the existing FastAPI server that receives GitHub webhook payloads and verifies their authenticity via HMAC-SHA256 signature checking.

RFC: #177 (GitHub Webhook to Swarm Notification Bridge)

Architecture decision: Option A -- dedicated endpoint on existing swarm server (not standalone service, not GitHub Actions).

Design

New File

• src/server/routes/github_webhook.py -- route handler, registered in create_app()

Environment Variables

• GITHUB_WEBHOOK_ENABLED (bool, default false) -- opt-in flag; when false, endpoint returns 404
• GITHUB_WEBHOOK_SECRET (string) -- shared secret for HMAC-SHA256 signature verification

Endpoint Behavior

• POST /api/github-webhook
• Read X-Hub-Signature-256 header from request
• Compute HMAC-SHA256 of request body using GITHUB_WEBHOOK_SECRET
• Compare signatures using hmac.compare_digest() (constant-time)
• Return 403 Forbidden if signature missing or invalid
• Return 200 OK for valid webhooks with handled event types
• Return 202 Accepted for valid webhooks with unhandled event types (e.g., push, star)
• Return 404 Not Found if GITHUB_WEBHOOK_ENABLED is false

Security

• HMAC-SHA256 verification is mandatory -- no unsigned requests accepted
• Use constant-time comparison to prevent timing attacks
• Each agent manages their own webhook secret for their repos

Acceptance Criteria

• POST /api/github-webhook endpoint exists and is registered in FastAPI app
• HMAC-SHA256 signature verification works correctly against X-Hub-Signature-256 header
• Returns 403 for missing or invalid signatures
• Returns 200 for valid webhooks with supported event types
• Returns 202 for valid webhooks with unsupported event types
• Returns 404 when GITHUB_WEBHOOK_ENABLED is false
• Uses hmac.compare_digest() for constant-time comparison
• GITHUB_WEBHOOK_SECRET read from environment variable
• Unit tests cover signature verification (valid, invalid, missing)
• No dependencies on other issues -- this is the foundation

Dependencies

None -- this is the foundation issue.