feat: add signed Linear webhook intake

[IYENTeam]

Problem

op_pi needs a closed-by-default HTTP intake for Linear webhooks so signed Linear events can enter the existing routing pipeline without accepting spoofed, stale, oversized, or unbounded traffic.

Requested contract

• add signed POST /linear
• verify Linear-Signature as HMAC-SHA256 over the exact raw request body
• reject missing/invalid signatures and stale/future timestamps outside the documented window
• bound body size, body-read concurrency/time, request rate, delivery-header size, and replay state
• admit to the internal event queue before returning success; fail closed when configuration or queue capacity is unavailable
• emit deterministic generic linear.<type>-<action> events while preserving the signed payload and correlation metadata
• keep Linear configuration optional and redact credentials from config show
• document response/retry semantics, delivery limitations, and required reverse-proxy controls

Acceptance checks

• existing configs continue to parse with the intake disabled by default
• exact raw-body signature vectors and timestamp boundaries are tested
• replay, saturation, queue failure/retry, body limit/timeout, rate limit, and header-limit behavior are tested
• config storage permissions and credential redaction are tested
• cargo fmt --all -- --check, cargo clippy --all-targets --all-features, cargo test, and release build pass
• real Linear webhook delivery is exercised and the observed result is recorded
• public/config/runtime contract and reverse-proxy responsibilities receive owner approval before merge

Scope boundaries

No Linear polling, OAuth, webhook provisioning, persistent deduplication, exactly-once delivery, or proxy/tunnel provisioning.

Implementation

PR #19