security: add timing-safe HMAC-SHA256 webhook signature verification for GitHub App

[Darkdruce]

Closes #765

Implements HMAC-SHA256 timing-safe signature verification for all /api/admin/webhooks/ routes.

• Adds verifyGitHubSignature and withGitHubWebhookAuth in src/lib/github/github-webhook.ts
• Missing X-Hub-Signature-256 header returns 401 with WWW-Authenticate: HMAC
• Invalid signatures return 401 and log source IP via structured logger
• Secret read exclusively from GITHUB_WEBHOOK_SECRET env var (never hardcoded)
• Applied to all /api/admin/webhooks/dlq and /api/admin/webhooks/replay routes
• Tests cover valid sig, invalid sig, missing header, and timing-safe comparison

[drips-wave]

@Darkdruce Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits