Build core form ingestion and durable webhook delivery

[quangshuynh]

Summary

Builds the initial Hymical Forms backend from ingestion through durable webhook delivery.

Included

• HTML form ingestion
• persisted endpoints and submissions
• configurable validation limits
• PostgreSQL-backed persistence
• idempotent submission handling
• signed HMAC-SHA256 webhooks
• transactional delivery outbox
• separate webhook worker
• bounded exponential retries
• worker leases and crash recovery
• delivery attempt history
• SSRF protections for obvious private/local targets
• automated tests, Ruff, mypy, and CI

Reliability guarantees

• submissions are persisted before 202 Accepted
• webhook work is created atomically with the submission
• idempotent retries do not create duplicate submissions or delivery jobs
• webhook delivery is at-least-once
• failed deliveries retry with bounded exponential backoff
• abandoned worker claims become eligible again after lease expiry

Current limitations

• no authentication or API keys
• one webhook destination per endpoint
• no failed-delivery replay API
• no database migrations yet
• PostgreSQL worker concurrency is not yet exercised live in CI
• SSRF protection does not yet resolve and pin hostnames
• no dashboard or frontend