feat(web): add opt-in webhook alert actions

An optional actions block in the config adds buttons to alerts. POST
/api/actions/{id} checks that the repository and the current alert match,
then sends the alert as JSON to the configured webhook with an optional
bearer token. The request refuses cross-site callers like POST /refresh.

GET /api/state lists the actions and merges per-alert status rows from an
optional status_url, cached for 10 seconds. Without an actions block the
API output does not change.

The ghtracker_action_requests_total counter records each result.

internal/web/api.go

@@ -10,13 +10,15 @@ import (
 // apiState is the JSON contract with the UI. Lists of healthy items stay on GitHub;
 // the UI gets counts, release info and the alerts that explain every non-green state.
 type apiState struct {
-	Now             time.Time     `json:"now"`
 	LastRefresh     time.Time     `json:"lastRefresh"`
+	Now             time.Time     `json:"now"`
+	ActionsError    string        `json:"actionsError,omitempty"`
+	Actions         []apiAction   `json:"actions,omitempty"`
 	Repos           []apiRepo     `json:"repos"`
 	Alerts          []apiAlert    `json:"alerts"`
 	Thresholds      apiThresholds `json:"thresholds"`
-	Counts          apiCounts     `json:"counts"`
 	Scan            apiScan       `json:"scan"`
+	Counts          apiCounts     `json:"counts"`
 	IntervalSeconds int64         `json:"intervalSeconds"`
 	Loaded          bool          `json:"loaded"`
 	Refreshing      bool          `json:"refreshing"`
@@ -85,13 +87,14 @@ type apiRelease struct {
 }
 
 type apiAlert struct {
-	Since    time.Time `json:"since"`
-	Repo     string    `json:"repo"`
-	Kind     string    `json:"kind"`
-	Severity string    `json:"severity"`
-	Subject  string    `json:"subject"`
-	Detail   string    `json:"detail"`
-	URL      string    `json:"url"`
+	Since        time.Time                  `json:"since"`
+	ActionStatus map[string]apiActionStatus `json:"actionStatus,omitempty"`
+	Repo         string                     `json:"repo"`
+	Kind         string                     `json:"kind"`
+	Severity     string                     `json:"severity"`
+	Subject      string                     `json:"subject"`
+	Detail       string                     `json:"detail"`
+	URL          string                     `json:"url"`
 }
 
 func seconds(d time.Duration) int64 { return int64(d / time.Second) }