fix(#2164): domain-URL webhooks + HMAC + config-PR polling fallback

Both webhook registrations (knowledge push + config-PR pull_request) now
use the public hive domain instead of loopback:
  https://<HYPERHIVE_HIVE_DOMAIN>/webhook/{knowledge,config-pr}

This routes deliveries through the gateway, bypassing the Forgejo SSRF
guard that blocked loopback delivery and silently broke the config-PR
merge flow since launch.

Changes:
- webhook_secret: new module — auto-generate + persist a 32-byte HMAC
  secret to STATE_ROOT/webhook-secret on first startup; verify
  X-Hub-Signature-256 on every incoming webhook POST (HMAC-SHA256).
- forge/mod.rs: ensure_config_pr_webhook now takes hive_domain +
  webhook_secret; sets secret in Forgejo hook config.
- workers/knowledge.rs: ensure_webhook same update.
- dashboard/webhook.rs: both handlers read raw Bytes first, verify HMAC,
  then parse JSON. Returns 401 on signature mismatch.
- dashboard/mod.rs: AppState carries webhook_secret; serve() takes it.
- main.rs: load/generate secret at startup; pass to registration tasks
  + dashboard; add 5-minute config-PR polling fallback task.
- forge/config_pr_poll.rs: new — scan agent-configs/* for open PRs with
  no pending MergeConfigPr approval; queue them. Idempotent.
- stores/approvals.rs: has_pending_merge_config_pr() for poll dedup.
- nix/modules/hive-gateway.nix: remove dashboardAuth from /webhook/
  location (HMAC replaces basic auth for webhook endpoints; Forgejo
  cannot send HTTP Basic credentials with webhook deliveries).

hive-c0re/src/stores/approvals.rs

@@ -136,6 +136,21 @@ impl Approvals {
         Ok(())
     }
 
+    /// Return `true` when there is already a `pending` `merge_config_pr`
+    /// approval for `(agent, pr_number)`. Used by the polling fallback to
+    /// skip re-submitting approvals that were already queued by the webhook.
+    pub fn has_pending_merge_config_pr(&self, agent: &str, pr_number: u64) -> Result<bool> {
+        let conn = self.conn.lock().unwrap();
+        let count: i64 = conn.query_row(
+            "SELECT COUNT(*) FROM approvals \
+              WHERE agent = ?1 AND kind = 'merge_config_pr' \
+                AND commit_ref = ?2 AND status = 'pending'",
+            params![agent, pr_number.to_string()],
+            |row| row.get(0),
+        )?;
+        Ok(count > 0)
+    }
+
     /// Last `limit` resolved approvals (approved / denied / failed),
     /// newest-first. Drives the history tab on the dashboard.
     pub fn recent_resolved(&self, limit: u64) -> Result<Vec<Approval>> {