Outbound webhooks: Standard Webhooks v1.

Added

• Four event types — contact.created, page.published, sale.paid, sale.refunded — each emitted transactionally with the domain mutation.
• Standard Webhooks v1 signing: webhook-id / webhook-timestamp / webhook-signature headers, HMAC-SHA256, whsec_ secrets, dual-signature rotation overlap.
• Retry ladder: up to 8 attempts over roughly 41 hours (30s, 2m, 10m, 1h, 4h, 12h, 24h) with jitter; only 2xx counts as delivered.
• Failure ladder: 20 consecutive failed deliveries auto-disable the endpoint and notify the workspace owner; re-enable and replay over the API.
• Webhook endpoint management operations on /v1: create (with signed verification event), get, list, update, delete, test, rotate-secret, deliveries, resend, replay.