[SECURITY] E5-4: Webhook payloads not signed — no X-Aegis-Signature header

[OneStepAt4time]

Finding

ID: Enterprise Gap | Severity: 🟠 MEDIUM

No X-Aegis-Signature header on outbound webhooks. Receivers cannot verify payload authenticity.

Fix Required

1. Add webhookSecret?: string to webhook channel config
2. Sign payload with HMAC-SHA256(webhookSecret, body) and include as X-Aegis-Signature: sha256=<hex>

Files: src/channels/webhook.ts, src/config.ts

Acceptance Criteria

Webhook receiver validates X-Aegis-Signature and rejects tampered payloads.

Milestone

M-E5: API & Integration

[OneStepAt4time]

Implemented in PR #1524 (merged). HMAC-SHA256 signing via X-Aegis-Signature header on all webhook deliveries.