[Feature]: Inbound & Outbound Webhooks (CRM & Pipeline Integration)

[espdesign]

Summary

Introduce an event-driven webhook pipeline supporting inbound task creation/updates from external services (CRMs, GitHub, Zapier) and outbound webhook notifications triggered by task lifecycle events via the transactional Outbox system.

Background & Context

Bridging Discord project management with external business and engineering pipelines (sales CRMs, bug tracking, CI/CD) was identified in early architecture planning to eliminate context switching across teams.

Proposed Capabilities

1. Inbound Webhook Endpoints:
   • Authenticated endpoints (e.g., /api/v1/webhooks/tasks) protected by API tokens or HMAC secret signatures.
   • Allows external systems to create tasks under designated projects, assign squad members, set priorities, and attach metadata.
   • Idempotency key support to avoid duplicate tasks during webhook retries.
2. Outbound Webhook Dispatcher:
   • Dispatches HTTP POST notifications to registered subscriber endpoints via the transactional Outbox system.
   • Subscribable event types: task.created, task.completed, task.status_changed, task.blocked.
   • Rich JSON payloads including task metadata, project prefix, assignee info, and Discord thread jump URLs.
   • Built-in retry with exponential backoff and rate-limit handling.

Acceptance Criteria

• Administrators can register outbound webhook URLs and select subscribed event types.
• Outbound webhooks dispatch asynchronously via the Outbox worker without delaying database commits.
• Inbound task creation automatically provisions the Thread Workspace, Task Action Card, and Forum tags.
• Unit and integration tests covering signature verification, payload schemas, and retry policies.