fix(#2164): domain-URL webhooks + HMAC + config-PR polling fallback

Both webhook registrations (knowledge push + config-PR pull_request) now
use the public hive domain instead of loopback:
  https://<HYPERHIVE_HIVE_DOMAIN>/webhook/{knowledge,config-pr}

This routes deliveries through the gateway, bypassing the Forgejo SSRF
guard that blocked loopback delivery and silently broke the config-PR
merge flow since launch.

Changes:
- webhook_secret: new module — auto-generate + persist a 32-byte HMAC
  secret to STATE_ROOT/webhook-secret on first startup; verify
  X-Hub-Signature-256 on every incoming webhook POST (HMAC-SHA256).
- forge/mod.rs: ensure_config_pr_webhook now takes hive_domain +
  webhook_secret; sets secret in Forgejo hook config.
- workers/knowledge.rs: ensure_webhook same update.
- dashboard/webhook.rs: both handlers read raw Bytes first, verify HMAC,
  then parse JSON. Returns 401 on signature mismatch.
- dashboard/mod.rs: AppState carries webhook_secret; serve() takes it.
- main.rs: load/generate secret at startup; pass to registration tasks
  + dashboard; add 5-minute config-PR polling fallback task.
- forge/config_pr_poll.rs: new — scan agent-configs/* for open PRs with
  no pending MergeConfigPr approval; queue them. Idempotent.
- stores/approvals.rs: has_pending_merge_config_pr() for poll dedup.
- nix/modules/hive-gateway.nix: remove dashboardAuth from /webhook/
  location (HMAC replaces basic auth for webhook endpoints; Forgejo
  cannot send HTTP Basic credentials with webhook deliveries).

nix/modules/hive-gateway.nix

@@ -741,8 +741,10 @@ in
           };
 
           # Shared auth block — separate locations don't inherit auth_basic, so
-          # each dashboard location (`/`, `/api/`, `/webhook/`) needs it or that
-          # surface is unauthed.
+          # each dashboard location (`/`, `/api/`) needs it or that surface is
+          # unauthed. `/webhook/` is intentionally excluded: Forgejo cannot
+          # send HTTP Basic credentials with webhook deliveries, and the HMAC
+          # secret (`X-Hub-Signature-256`) protects those endpoints instead.
           dashboardAuth = lib.optionalString cfg.auth.enable ''
             auth_basic "${cfg.auth.realm}";
             auth_basic_user_file /run/hive-state/gateway.htpasswd;
@@ -754,8 +756,9 @@ in
           # Dashboard: nginx static-serves the dist, c0re is API-only. Routing
           # is by PATH, never content-type. c0re serves exactly two prefixes —
           # `/api/` (all dashboard data + actions + the SSE streams) and
-          # `/webhook/` (the knowledge webhook) — so those proxy to c0re and
-          # everything else serves the dist with an SPA fallback to index.html.
+          # `/webhook/` (knowledge push + config-PR approval triggers, HMAC-
+          # guarded) — so those proxy to c0re and everything else serves the
+          # dist with an SPA fallback to index.html.
           # The earlier `map $http_accept` Accept-header split made the SAME
           # url behave differently by content-type (e.g. `/api/state` fetched
           # with `Accept: text/html` wrongly got index.html); path routing is
@@ -781,8 +784,10 @@ in
               '';
             };
             "/webhook/" = {
+              # No dashboardAuth here: Forgejo cannot send HTTP Basic credentials
+              # with webhook deliveries. HMAC (X-Hub-Signature-256) is the auth
+              # for these endpoints; hive-c0re verifies it in the handler.
               proxyPass = "http://${cfg.upstreamHost}:${toString cfg.upstreamPort}";
-              extraConfig = dashboardAuth;
             };
           };
         in