Webhook delivery on click events

[Yentec]

Context

Analytics is currently pull-based: clients query /v1/links/:id/stats. For integrations (Slack notifications, CRM sync, real-time dashboards), users need push delivery.

Goal

Allow users to register a webhook URL per workspace/key and receive a signed HTTP POST on each click event.

Approach

• New resource: Webhook { id, userId, url, secret, events[], createdAt, lastDeliveredAt }.
• After a click is persisted, enqueue a webhook-delivery job in a new BullMQ queue.
• Worker POSTs { event: 'click', linkId, occurredAt, country, deviceType, browser, referrerHost } with an X-LinkForge-Signature: sha256=<hmac> header (HMAC-SHA256 of the body using the per-webhook secret).
• Retry with exponential backoff (5 attempts), then mark delivery as failed.

Acceptance criteria

• CRUD endpoints for webhooks (with scopes)
• HMAC signature documented in the README + verifier snippet in 3 languages
• Delivery worker with retry and DLQ-style failed tracking
• Integration test with a local HTTP target (e.g., a Fastify subapp in tests)

Open questions

• Per-user delivery quota?
• Should we offer event filtering (e.g., only on first click per IP hash)?