feat: add Webhooks v2 with HMAC signature, retries (2s/10s/60s), and 20+ new events

- Add HMAC SHA-256 signature verification for webhook payloads
- Implement retry logic with delays (2s, 10s, 60s) and max 4 attempts
- Add 20+ new events (total ~50 events) covering pages, blocks, users, etc.
- Add API v2 endpoints for testing HMAC signature and retrying deliveries
- Add comprehensive test suite for webhooks v2 functionality

Generated by opencode.

app/routers/api_v2.py

@@ -2361,8 +2361,8 @@ async def test_webhook_v2(webhook_id: int, request: Request, authorization: str
 
 @router.get("/webhooks/{webhook_id}/deliveries")
 async def list_deliveries_v2(webhook_id: int, request: Request,
-                             status: str | None = None,
-                             authorization: str | None = Header(default=None)):
+                              status: str | None = None,
+                              authorization: str | None = Header(default=None)):
     user = get_bearer_user(request, authorization)
     _v2_rate_check(request, user)
     limit, offset = parse_pagination(request)
@@ -2387,3 +2387,53 @@ async def list_deliveries_v2(webhook_id: int, request: Request,
         content={"deliveries": [row_to_dict(r) for r in rows]},
         headers=paginate_headers(total),
     )
+
+
+@router.post("/webhooks/{webhook_id}/retry")
+async def retry_webhook_deliveries(webhook_id: int, request: Request,
+                                    authorization: str | None = Header(default=None)):
+    """Manually retry failed deliveries for a webhook."""
+    user = get_bearer_user(request, authorization)
+    _v2_rate_check(request, user)
+    if not has_scope(user.get("_token_scopes"), "write"):
+        raise HTTPException(403, "Insufficient scope. Required: write")
+    
+    from app.services.webhook_outbound import retry_due_deliveries
+    
+    with get_conn() as conn:
+        # Force retry by setting next_retry_at to the past
+        conn.execute(
+            """UPDATE webhook_deliveries 
+               SET next_retry_at = strftime('%s', 'now', '-1 second')
+               WHERE webhook_id = ? AND status = 'retrying'""",
+            (webhook_id,),
+        )
+        conn.commit()
+    
+    retried = await retry_due_deliveries()
+    audit_log(user, "webhook.retry", "webhook", webhook_id, f"retried={retried}", request)
+    return {"webhook_id": webhook_id, "status": "retried", "retried_count": retried}
+
+
+@router.post("/webhooks/verify-signature")
+async def verify_webhook_signature(request: Request,
+                                    authorization: str | None = Header(default=None)):
+    """Verify a webhook signature (for debugging/testing)."""
+    user = get_bearer_user(request, authorization)
+    _v2_rate_check(request, user)
+    
+    from app.services.webhook_outbound import verify_signature
+    
+    try:
+        body = await request.json()
+    except Exception:
+        body = {}
+    
+    secret = body.get("secret", "")
+    payload = body.get("payload", "{}")
+    signature = body.get("signature", "")
+    
+    is_valid = verify_signature(secret, payload.encode(), signature)
+    
+    audit_log(user, "webhook.signature_verify", "webhook", 0, f"valid={is_valid}", request)
+    return {"valid": is_valid, "secret": secret[:10] + "..." if len(secret) > 10 else secret}