Problem: webhooks are configured but never fired (audit: src/handlers/webhooks.ts).
Scope: deliver subscribed events (pageview/error/goal/alert) to the URL with HMAC signature, retries/backoff, and failure tracking/disable.
Done when: a configured webhook receives signed event deliveries.