fix(security): add HMAC signature to Process Engine outbound webhooks (#266)

[dolho]

Summary

• Add X-Trinity-Signature (HMAC-SHA256) and X-Trinity-Timestamp headers to all outbound webhook calls from the Process Engine
• Signing key derived from SECRET_KEY via HMAC(SECRET_KEY, "webhook-signing") — no extra config needed
• Payload serialized with sort_keys=True and compact separators for deterministic signatures

Changes

• src/backend/services/process_engine/events/webhook_publisher.py — HMAC signing in _send_webhook(), new _compute_signature() static method
• tests/unit/test_webhook_signature.py — 10 unit tests (determinism, sensitivity, header verification, receiver verification, serialization)

Receiver Verification

Receivers should verify signatures like this:

import hmac, hashlib, json, time

def verify(body: bytes, timestamp: str, signature: str, secret_key: str) -> bool:
    if abs(time.time() - int(timestamp)) > 300:  # 5-min replay window
        return False
    signing_key = hmac.new(secret_key.encode(), b"webhook-signing", hashlib.sha256).digest()
    expected = hmac.new(signing_key, f"{timestamp}.".encode() + body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(signature.removeprefix("v1="), expected)

Test Plan

• 10 unit tests passing: pytest tests/unit/test_webhook_signature.py -v
• Manual: trigger a process with webhook configured, verify headers present

Closes #266

🤖 Generated with Claude Code