Webhook-triggered workflow run

Looks up the workflow by token, verifies an HMAC-SHA256 signature (hex
digest) over "{X-Webhook-Timestamp}.{body}" using the per-workflow
secret, with a +/- 5 minute timestamp window for replay protection, and
starts a run with the body as input. Same-body retries without an
Idempotency-Key collapse onto the first run for a short window.

Send X-Webhook-Test: 1 to deliver a test event instead: the request is
verified the same way, but no run starts. The body is stored as the
workflow's sample (also before it is published) and echoed back with a
200, so the dashboard can offer its fields as run inputs.