feat(orb): central Orb App webhook receiver (POST /v1/orb/webhook)

[JSONbored]

Summary

The first piece of the central Gittensory Orb GitHub App (#1255) — the one shared app maintainers install (the das-github-mirror model). GitHub delivers its install + PR/review events to POST /v1/orb/webhook on gittensory-api; this is the data spine for the homepage fleet metrics (reviews initiated / merged / closed / reversals).

It ports the proven src/github/webhook.ts handler verbatim — only the secret and the dedup table differ:

• Verifies the Orb App's own webhook secret (ORB_GITHUB_WEBHOOK_SECRET, distinct from the review app's GITHUB_WEBHOOK_SECRET). Absent secret → fail-closed 401, so the route is inert until the secret is injected (wrangler secret put).
• Its own orb_webhook_events dedup table (migration 0063) — a GitHub delivery_id is only unique per App, so it can't safely share webhook_events with the review app.
• Body-size cap, signature verification, dedup, and identical 202/400/401/413 responses. Exempt from requiresApiToken; strict rate-limit class (same as /v1/github/webhook).

Receive + verify + record only — install-registry and PR-outcome processing land in follow-up PRs (#2–#7 of the Orb-app sequence). Purely additive: the live /v1/orb/ingest collector, orb_signals, and fleet analytics are untouched. The endpoint must exist now because GitHub starts POSTing install/ping deliveries the moment the Orb App is created.

Scope

• 6 files; migration 0063_orb_webhook_events.sql is the next contiguous number
• Additive only — no existing route/path/table behavior changed; new env binding is optional + fail-closed

Validation

• npm run test:ci — green (db:migrations:check, typecheck, coverage, workers, ui)
• 100% branch coverage on src/orb/webhook.ts (15 cases: missing headers, absent/invalid signature, content-length vs streamed 413, non-JSON, install-event extraction, null-field payloads, redelivery dedup, changed-payload re-record, processed/error status handling, empty-body, undefined-chunk, non-numeric content-length)

Safety

• Fail-closed: no secret / bad signature → 401; never trusts an unverified payload
• Own dedup table avoids cross-App delivery_id collision with the review app

Deploy note

After merge + auto-deploy, inject the secret: wrangler secret put ORB_GITHUB_WEBHOOK_SECRET (the value you set in the Orb App's webhook config). Until then every delivery returns 401 — no crash, no data loss.

Advances #1255.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.09%. Comparing base (a3edd8e) to head (2f6f189).
⚠️ Report is 3 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1293      +/-   ##
==========================================
+ Coverage   95.07%   95.09%   +0.01%     
==========================================
  Files         178      179       +1     
  Lines       20039    20092      +53     
  Branches     7206     7228      +22     
==========================================
+ Hits        19053    19106      +53     
  Misses        395      395              
  Partials      591      591              

Files with missing lines	Coverage Δ
src/api/routes.ts	94.44% <100.00%> (+<0.01%)	⬆️
src/auth/rate-limit.ts	98.76% <100.00%> (+0.01%)	⬆️
src/orb/webhook.ts	100.00% <100.00%> (ø)

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.