Description

This PR introduces the core Generic Webhooks engine, allowing external integrations to trigger workflows. Following the previous review, this branch addresses all requested security enhancements, migration ordering, and WhatsApp API routing logic.

Note: This is the final part of splitting up the previous monolithic PR.

Key Changes & Review Feedback Addressed

• Marketing Endpoint Routing: Addressed the assumption that all accounts are enrolled in Meta's Marketing Messages Lite API. Gated the /marketing_messages endpoint behind a new use_marketing_endpoint config flag on the whatsapp_config table (configurable via the UI). It now safely falls back to /messages for standard accounts.
• Webhook Security (HMAC): Implemented cryptographic signature verification in the webhook receiver. Integrations now require an HMAC Secret to validate incoming requests, preventing unauthorized execution.
• Webhook Rate Limiting: Added basic rate-limiting (src/lib/rate-limit.ts) to cap incoming webhooks at 60 requests per minute per workflow, preventing abuse.
• Configurable Phone Prefix: Removed the hardcoded 91 country code. The default country code prefix is now fully configurable via the database and Webhooks UI settings.
• Clean Migration Sequence: All custom migrations on this branch have been correctly re-sequenced (038 through 041) to start immediately after the latest upstream migrations, preventing any collision with upstream's 036.
• UI Polish: Renamed placeholder bot names in the live WhatsApp preview to a generic "WhatsApp Bot".

Testing

• Webhook endpoints correctly reject requests with invalid or missing HMAC signatures.
• Rate limiting correctly throttles requests exceeding 60/min.
• Meta API routing correctly respects the use_marketing_endpoint flag in integration tests.
• All 664 unit tests run and pass without regressions (npm run test).
• TypeScript compiles cleanly (npm run typecheck).