feat(pr): webhook 数据源接收端 + Cloudflare Quick Tunnel 公网代理（#9）

src-tauri/Cargo.toml

@@ -23,7 +23,19 @@ tauri-plugin-opener = "2"
 tauri-plugin-store = "2"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
-tokio = { version = "1", features = ["time", "sync", "macros", "process", "io-util"] }
+tokio = { version = "1", features = ["time", "sync", "macros", "process", "io-util", "net"] }
+# Local webhook receiver (#9): a single `POST /webhook` endpoint bound to
+# 127.0.0.1, reached from the public internet via a Cloudflare Quick Tunnel
+# (`cloudflared` subprocess). axum is the idiomatic tokio HTTP server — its async
+# handler calls the same `auto_dispatch` path the scheduler uses with zero
+# sync→async bridging. `json` feature is unused (we read the raw body via the
+# `Bytes` extractor to HMAC-verify the GitHub `X-Hub-Signature-256` before parsing).
+axum = { version = "0.7", default-features = false, features = ["tokio", "http1"] }
+# GitHub webhook HMAC-SHA256 signature verification (`X-Hub-Signature-256`).
+# `hmac::Mac::verify_slice` is constant-time. `hex` decodes the `sha256=<hex>` header.
+hmac = "0.12"
+sha2 = "0.10"
+hex = "0.4"
 # `future::join_all` drives the auto-trigger dispatcher's unbounded concurrent
 # `start_review` calls in a single task. The engines hold `&` borrows of the
 # resident `CodexManager`/`SessionRegistry` (neither `Clone`), so spawning each