feat: add signed webhook event system

[Spina7]

Summary

• Adds webhook endpoints for creating, listing, updating, deleting, and inspecting delivery attempts.
• Emits signed HMAC-SHA256 webhook deliveries for expense, category, and bill events.
• Records delivery attempts, retries failures, and persists status/error details.
• Documents supported event types and webhook APIs in OpenAPI.

Closes #77

Webhook signing

Each delivery includes:

• X-FinMind-Event
• X-FinMind-Delivery
• X-FinMind-Timestamp
• X-FinMind-Signature

The signature is sha256=<hmac> over timestamp.body using the endpoint secret.

Verification

• python -m py_compile app/__init__.py app/models.py app/routes/__init__.py app/routes/webhooks.py app/routes/expenses.py app/routes/categories.py app/routes/bills.py app/services/webhooks.py
• PYTHONPATH=. pytest -q tests/test_webhooks.py → 3 passed
• OpenAPI YAML parse check for /webhooks and WebhookDelivery
• git diff --check

Note: the full backend test suite currently attempts to connect to redis:6379 from existing auth/cache tests in this local environment and fails before reaching most app behavior. The new webhook tests avoid external Redis and pass in isolation.