feat: add Docker support and inbound webhooks (Tier 2)

- Dockerfile: multi-stage build (node:22-alpine), better-sqlite3 native deps handled
- .dockerignore + docker-compose.yml for deployment
- FLYNN_DATA_DIR env var support in daemon, CLI, and TUI
- WebhookHandler: ChannelAdapter for HTTP POST /webhooks/:name
- Per-webhook HMAC auth, template rendering ({{body}}, {{json.field}})
- Config schema: automation.webhooks array with name/secret/message/output
- Gateway routes webhook requests before static files (bypasses gateway auth)
- 23 new tests for webhook functionality, 874 total tests passing

src/gateway/server.ts

@@ -24,6 +24,7 @@ import type { SessionManager } from '../session/manager.js';
 import type { Config } from '../config/index.js';
 import type { ToolRegistry } from '../tools/registry.js';
 import type { ToolExecutor } from '../tools/executor.js';
+import type { WebhookHandler } from '../automation/webhooks.js';
 
 export interface GatewayServerConfig {
   port: number;
@@ -42,6 +43,8 @@ export interface GatewayServerConfig {
   /** Optional callback for system.restart. Should trigger graceful shutdown + process restart. */
   restart?: () => Promise<void>;
   channelRegistry?: { list(): Array<{ readonly name: string; readonly status: string }> };
+  /** Optional webhook handler for inbound webhook HTTP routes. */
+  webhookHandler?: WebhookHandler;
 }
 
 export class GatewayServer {
@@ -207,9 +210,19 @@ export class GatewayServer {
   /**
    * Handle incoming HTTP requests.
    * Optionally applies auth (when authHttp is enabled and a token is configured).
-   * Delegates to serveStatic for UI files; returns 404 if no UI dir or file not found.
+   * Routes webhook requests before auth; delegates to serveStatic for UI files.
    */
   private async handleHttpRequest(req: IncomingMessage, res: ServerResponse): Promise<void> {
+    // Webhook routes bypass gateway auth (they have their own HMAC auth)
+    if (this.config.webhookHandler && req.method === 'POST' && req.url) {
+      const match = req.url.match(/^\/webhooks\/([^/?]+)/);
+      if (match) {
+        const webhookName = decodeURIComponent(match[1]);
+        await this.config.webhookHandler.handleRequest(webhookName, req, res);
+        return;
+      }
+    }
+
     // Apply auth to HTTP requests when configured
     const authConfig = this.config.auth ?? {};
     if (this.config.authHttp !== false && authConfig.token) {
@@ -281,4 +294,9 @@ export class GatewayServer {
   getMethods(): string[] {
     return this.router.listMethods();
   }
+
+  /** Set the webhook handler for inbound webhook HTTP routes (late binding). */
+  setWebhookHandler(handler: WebhookHandler): void {
+    this.config.webhookHandler = handler;
+  }
 }