feat(bots): add outbound webhooks and retained operational logs

[hmans]

• What changed: Add outbound bot webhooks for direct mentions and direct messages. Each bot can have up to 20 named endpoints, each with its own signing secret and optional Authorization header. Managers can create, edit, pause, resume, and revoke endpoints. The integration sections share a consistent UI, with short help texts and webhook sections before API keys. Signing secrets appear only after creation.
• Why: Let external tools and workflows respond to Chatto messages. A bounded, process-local worker pool consumes EVT and retries failed requests with exponential backoff. Operators control retry limits and expiry through [core.bot_webhooks]. Delivery is best effort: restarts can lose accepted work, and source redelivery can cause duplicate requests. Stable delivery IDs let receivers detect duplicates. Workers check endpoint state and message access before each request.
• What changed: Add a separate protobuf LOG stream for retained webhook failures, with history in the bot management UI. The default retention is seven days, configured through [core.log]. Failure records contain safe categories and opaque IDs. Credentials are encrypted, Authorization headers remain write-only, and outbound requests use address checks and block redirects.
• Why: Make failures available across replicas without adding delivery records to EVT or introducing a durable job queue. LOG history is read directly from JetStream and is excluded from backups.
• What changed: Replace the test-bot project with a published Runling example in the repository and dev stack. It uses an OpenRouter agent, complete thread context, typing indicators, reply and web-fetch tools, Chatto documentation, and a fallback error reply. Fresh dev servers create TestBot's API key and outbound endpoint.
• Why: Provide a working example of an external bot that receives webhooks and sends replies through the Chatto API.
• How it was verified: Race-enabled webhook and LOG tests, bootstrap tests, and targeted API, configuration, outbound-address, and backup tests passed. All 31 bot UI tests, 39 Runling tests, and 7 translation catalogue tests passed. Svelte checks reported no errors or warnings. Protobuf compatibility against main and REUSE licence checks passed. Chrome DevTools checks covered webhook editing and compact actions on desktop and mobile. The complete PR diff was reviewed on the current commit; CI status is reported by the PR checks.
• Design and documentation: Bot accounts (FDR-038), outbound webhook delivery (ADR-097), retained operational log (ADR-098), effects inventory, and bot guide.