feat(webhook): Forgejo → Gotify notification bridge

POST /v1/webhooks/forgejo receives Forgejo payloads, verifies HMAC
SHA256 signature, formats event into Gotify push notification.

Supported events: push, pull_request, issues, issue_comment,
pull_request_review_comment, release.

Env vars: GOTIFY_URL, GOTIFY_APP_TOKEN, FORGEJO_WEBHOOK_SECRET
Secret: gotify-webhook-secret in api namespace

internal/server/router.go

@@ -4,6 +4,7 @@ import (
 	"net/http"
 
 	"forgejo.riotpiao.com/rock/homelab-frontend/internal/serviceadapter"
+	"forgejo.riotpiao.com/rock/homelab-frontend/internal/webhook"
 )
 
 // Router implements an HTTP handler that routes health endpoints,
@@ -14,6 +15,7 @@ type Router struct {
 	dispatcher        *serviceadapter.Dispatcher
 	temporalHandler   http.Handler
 	upstreamHandler   http.Handler
+	forgejoWebhook    *webhook.ForgejoHandler
 }
 
 // NewRouter creates a new router with health endpoints.
@@ -23,10 +25,11 @@ type Router struct {
 // All other paths are passed to the upstream handler.
 func NewRouter(healthChecker *HealthChecker, dispatcher *serviceadapter.Dispatcher, temporalHandler http.Handler, upstreamHandler http.Handler) *Router {
 	return &Router{
-		healthChecker:   healthChecker,
-		dispatcher:      dispatcher,
+		healthChecker:  healthChecker,
+		dispatcher:     dispatcher,
 		temporalHandler: temporalHandler,
 		upstreamHandler: upstreamHandler,
+		forgejoWebhook: webhook.NewForgejoHandler(),
 	}
 }
 
@@ -57,6 +60,12 @@ func (r *Router) ServeHTTP(w http.ResponseWriter, req *http.Request) {
 		}
 	}
 
+	// Forgejo webhook receiver — no auth, HMAC-verified by handler
+	if req.URL.Path == "/v1/webhooks/forgejo" {
+		r.forgejoWebhook.ServeHTTP(w, req)
+		return
+	}
+
 	// Workflow endpoints
 	// DEPRECATED: Path-based /workflow routing is legacy.
 	// New clients should use X-Service: workflow header instead for consistent auth.