[CT-38] Implement webhook dispatch on verification events

[mftee]

Overview

AppConfig parses and validates WEBHOOK_URLS (comma-separated) and WEBHOOK_SECRET from the environment, and main.rs logs webhook_urls on startup — but a search across contract/src shows no HTTP client call anywhere that actually POSTs to a webhook URL. The config exists; the delivery mechanism does not.

Files

• contract/src/config.rs (webhook_urls/webhook_secret already parsed)
• contract/src/lib.rs (new webhook dispatch call sites)

Acceptance Criteria

• Add a webhook module with a function that POSTs a signed event payload (HMAC using webhook_secret, following a standard X-Signature header convention) to each configured URL
• Fire a webhook on successful verify, submit (post CT-31), revoke (post CT-32), and transfer events, with the relevant record as the payload
• Dispatch is fire-and-forget / doesn't block the HTTP response (spawn a background task) and failures are logged, not propagated to the caller
• Add a test using a local mock HTTP server asserting the payload and signature header are correct