✨ Owner-facing GitHub webhook setup: Settings card, generated secret, create-hook, owner guide #18017

Problem

Turning GitHub webhooks on for hive's own spoke (hivecommons/hive → oke-11) cut kick latency and API spend. Other hive owners (e.g. @Danathar's self-hosted hive on projectbluefin repos) want the same, but today the setup is not discoverable: the receiver (POST /api/webhook/github), the secret (GITHUB_WEBHOOK_SECRET env only), the event list and the hub-relay path are documented across three operator pages, there is no dashboard surface that tells an owner what URL/secret/events to configure, and there is no way to mint a per-hive secret without a shell on the spoke. Hive's own webhook secret must never be shared; every owner needs their own.

What exists

• Spoke receiver pkg/dashboard/api_github_webhook.go: verifies X-Hub-Signature-256 against GITHUB_WEBHOOK_SECRET, or the hub's relay signature against the per-hive relay key (🐛 [v5] hosted hives reject every relayed GitHub webhook: the hub never gives the spoke a way to verify them #17911). Events invalidate PR cache, wake an early eval cycle, kick on CI failure, dispatch reviews, refresh the tracker.
• Hub relay pkg/hub/webhook.go: the hub verifies GitHub App deliveries and forwards them to every enrolled hive managing the repo whose dashboard URL is public, hub-signed with that hive's own relay key. Hosted spokes already get this with no owner action (verified on hive-oke: every hosted spoke with a managed repo receives relays).
• Health in /api/status.webhooks (events_1h, last_event_at, verification, mode).

Proposal

1. pkg/github: WebhookSecret() reads GITHUB_WEBHOOK_SECRET, else /data/github-webhook-secret.key (0600, same pattern as the relay key). Receiver and WebhookVerification() use it.
2. Owner-only API: GET /api/config/github/webhooks (payload URL, events, content type, verification mode, secret source, health, App hook permissions), POST /api/config/github/webhooks/secret (generate, store 0600, return once), POST /api/config/github/webhooks/create (create the org/repo hook through the App when the installation has organization_hooks / repository_hooks: write).
3. Settings → Forge App → GitHub webhooks card: exact payload URL, events to tick, content type, Generate secret (shown once, copy), Create webhook for me (only when the App permission is granted), live status / "no events yet" guidance, link to the guide.
4. src/docs/webhooks.md: owner guide for hosted (automatic via relay — verify only) and self-hosted (own webhook + own secret) hives, with troubleshooting (401 signature mismatch, 404 wrong path, 503 no secret, relay vs direct) and what improves when webhooks are on.