feat(gitsync): webhook-triggad synk + helt manuellt läge

- POST /api/git-hook: HMAC-SHA256-verifierad (X-Gitea-Signature),
  reagerar bara på pushar till live-grenen, svarar 202 och synkar async
- webhook-hemlighet genereras server-side (headless via config.json),
  roteras med gitRegenerateWebhookSecret
- auto_sync_minutes=0 + webhook av ⇒ ingen automatisk hämtning alls;
  webhook på ⇒ catch-up-synk vid uppstart (missade event)
- admin-UI: webhook-toggle, target-URL + secret med copy/rotate

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

backend/internal/config/config.go

@@ -37,8 +37,15 @@ type GitSyncConfig struct {
 	ReadOnly bool `json:"read_only"`
 	// AutoSyncMinutes > 0 enables background sync on that interval.
 	// Background pulls are fast-forward only; anything needing a real
-	// merge is left for an admin to resolve in the UI.
+	// merge is left for an admin to resolve in the UI. With 0 and
+	// webhook disabled, nothing is fetched automatically at all.
 	AutoSyncMinutes int `json:"auto_sync_minutes"`
+	// WebhookEnabled exposes POST /api/git-hook so the git host can
+	// trigger a sync on push instead of (or besides) polling.
+	WebhookEnabled bool `json:"webhook_enabled"`
+	// WebhookSecret authenticates hook calls (HMAC-SHA256 signature in
+	// X-Gitea-Signature). Generated by the server when left empty.
+	WebhookSecret string `json:"webhook_secret"`
 }
 
 // Normalize fills in defaults for optional git-sync fields.