Implement signed webhook event delivery

[sitarua]

Summary

• Adds user-managed webhook endpoints and queued delivery records.
• Signs webhook payloads with X-FinMind-Signature HMAC headers and includes event, delivery, and timestamp headers.
• Adds retry/failure handling via flask process-webhooks and POST /webhooks/deliveries/run.
• Publishes expense, bill, and reminder lifecycle events.
• Documents supported event types in README and OpenAPI.

Validation

• python -m black --check app tests
• python -m flake8 app tests
• python -m pytest -q tests (local venv with temporary in-memory Redis protocol test server because Docker/Redis are not available in this environment)

Security and Ownership

• PR opened from a fork
• No secrets added
• No unrelated files changed

Closes #77