mathias
394a227877
Adds POST /webhooks/brain-sync: verifies Gitea's HMAC-SHA256 signature, checks the push is to mathias/brain main, then creates a one-off Job from the existing brain-sync CronJob's template (same script the 15-min poll already runs, just triggered on-demand). Off by default -- opt in via GITEA_WEBHOOK_SECRET, since it needs Job-create RBAC in the "brain" namespace a fresh deploy won't have. 10 new tests (internal/webhook), including a fake-clientset reactor to simulate server-side GenerateName expansion, which the plain fake tracker doesn't do on its own. Needs (follow-up, infra repo): RBAC granting ingestion's ServiceAccount get on cronjobs/brain-sync + create on jobs in the brain namespace, the GITEA_WEBHOOK_SECRET env, and the actual Gitea webhook registration.