feat: add Uptime Kuma event source

[shivros]

Summary

• Adds a secret-required Uptime Kuma heartbeat source using base64 HMAC-SHA256 Signature verification.
• Normalizes deterministic heartbeat actions/severity and matching-safe metadata, including correct seconds-to-milliseconds duration conversion.
• Replaces GitHub-only ingress dispatch with a configured source registry while retaining the generated receive_event operation and status contract.

Verification

• cargo build --all-targets
• cargo test --all-targets (21 tests)
• cargo clippy --all-targets -- -D warnings
• cargo fmt --all -- --check
• git diff --check

Closes COD-465.

[shivros]

🤖 Automated Review Panel

Reviewer A — gpt-5.6-terra

MAJOR (resolved): Uptime Kuma's heartbeat.duration is specified in seconds, while the normalized field is duration_ms. The implementation now converts seconds × 1,000 and has a regression assertion for 5 → 5000 ms.

Reviewer B — independent review

APPROVE: No correctness or goal-alignment findings.

Both reviewers assessed the COD-465 goal, registry migration, authentication semantics, and diff. The actionable duration finding was fixed before the final full build/test/clippy/fmt/diff gate.

[shivros]

Auto-Merge Gate

Verdict: MERGE (squash) — confidence 0.90

Rationale: PR implements COD-465 fully: new UptimeKumaSource (base64 HMAC-SHA256 Signature verification via verify_slice, secret-required per Shiv's ruling), deterministic status→action/severity mapping (0=down/Critical, 1=up/Info, 2=pending/Warning, 3=maintenance/Info, unknown → parse error), normalization honoring archon's clarification comment (monitor name required; optional monitor_id/url/ping_ms/duration_ms/heartbeat_time only when present; msg → body; seconds→ms conversion with regression test 5 → 5000.0), source-registry dispatch replacing the GitHub hardcode while preserving the exact 404/401/400/202 status contract, config validation + startup summary data-driven, README + example TOML updated. Reviewer A's MAJOR duration-units finding is verifiably fixed in the diff; Reviewer B found no correctness/goal issues.

Checks observed (all green): test (rite CI).

Independent local verification (disposable clone, TechGodHQ/rite @ e424144): cargo build --all-targets ✓ · cargo test --all-targets ✓ · cargo clippy --all-targets -- -D warnings ✓ · cargo fmt --all -- --check ✓.

Scope limits: No secrets exposed or logged (secret held as bytes, never in Debug output paths); webhook secret is user-supplied config, not a credential of this repo. Linked Linear COD-465 scanned for manual-review markers — none.