feat(integrations): webhooks for flag change events

[trinhvandat]

Context (P2 — product)

Polling-only SDKs mean slow flag propagation, and there is no way to notify external systems (Slack, CI, audit sinks) of flag changes.

Scope

• Webhook subscription entity per environment (url, secret, enabled, event types) + CRUD admin endpoints + Liquibase changeset
• Events: flag created/updated/archived, flag-state changed, API key rotated
• Async delivery (Spring @Async/executor) with HMAC-SHA256 signature header, retry with backoff (e.g. 3 attempts), delivery-attempt log
• SSRF guard: block deliveries resolving to private/loopback ranges (configurable)

Acceptance criteria

• Flag-state change triggers signed POST to subscribed URL (integration test with local stub server)
• Failed deliveries retried with backoff and recorded
• Signature verifiable with the shared secret; secret hashed/encrypted at rest
• SSRF guard covered by tests