feat: add Docker support and inbound webhooks (Tier 2)

- Dockerfile: multi-stage build (node:22-alpine), better-sqlite3 native deps handled
- .dockerignore + docker-compose.yml for deployment
- FLYNN_DATA_DIR env var support in daemon, CLI, and TUI
- WebhookHandler: ChannelAdapter for HTTP POST /webhooks/:name
- Per-webhook HMAC auth, template rendering ({{body}}, {{json.field}})
- Config schema: automation.webhooks array with name/secret/message/output
- Gateway routes webhook requests before static files (bypasses gateway auth)
- 23 new tests for webhook functionality, 874 total tests passing

src/config/schema.ts

@@ -108,8 +108,20 @@ const cronJobSchema = z.object({
   timezone: z.string().optional(),
 });
 
+const webhookSchema = z.object({
+  name: z.string().min(1, 'Webhook name is required'),
+  secret: z.string().optional(),
+  message: z.string().default('{{body}}'),
+  output: z.object({
+    channel: z.string().min(1),
+    peer: z.string().min(1),
+  }),
+  enabled: z.boolean().default(true),
+});
+
 const automationSchema = z.object({
   cron: z.array(cronJobSchema).default([]),
+  webhooks: z.array(webhookSchema).default([]),
 }).default({});
 
 const agentsSchema = z.object({
@@ -299,6 +311,7 @@ export type Config = z.infer<typeof configSchema>;
 export type TelegramConfig = z.infer<typeof telegramSchema>;
 export type ModelConfig = z.infer<typeof modelConfigSchema>;
 export type CronJobConfig = z.infer<typeof cronJobSchema>;
+export type WebhookConfig = z.infer<typeof webhookSchema>;
 export type AgentsConfig = z.infer<typeof agentsSchema>;
 export type CompactionConfig = z.infer<typeof compactionSchema>;
 export type MemoryConfig = z.infer<typeof memorySchema>;