feat: add per-webhook secret with backfill migration (#13573)

db/migrate/20260218075101_add_secret_to_webhooks.rb

@@ -0,0 +1,5 @@
+class AddSecretToWebhooks < ActiveRecord::Migration[7.1]
+  def change
+    add_column :webhooks, :secret, :string
+  end
+end

db/migrate/20260226084618_backfill_webhook_secrets.rb

@@ -0,0 +1,11 @@
+class BackfillWebhookSecrets < ActiveRecord::Migration[7.1]
+  def up
+    Webhook.find_each do |webhook|
+      webhook.update!(secret: SecureRandom.urlsafe_base64(24))
+    end
+  end
+
+  def down
+    # no-op: removing the column in the previous migration handles cleanup
+  end
+end