feat(workflows): route webhook node through the delivery pipeline (full Option 1)

Replaces the one-shot guarded POST with the maintainer's intended end-state: the
webhook node now references a CONFIGURED webhook subscription (Settings →
Webhooks) and enqueues a real webhook_deliveries row via
webhookService.enqueueForWebhook. Delivery then rides the existing worker
pipeline, inheriting — not reimplementing — per-delivery SSRF re-validation
(validateExternalUrl / GHSA-wmjx-pc37-272r), HMAC signing with the
subscription's secret, retry/backoff, and the deliveries audit log.

- webhookService.enqueueForWebhook(webhookId, eventType, data): enqueue for one
  active subscription, bypassing fire()'s event-type matching. No schema change.
- webhook action: config.webhookId; unset/missing/inactive → observable skip;
  dry-run does not enqueue. event_type = workflow.<trigger>.
- Editor: webhook node config is now a subscription dropdown (was a raw URL),
  fed by the admin webhooks list, with a hint pointing to Settings → Webhooks.
- EN/DE strings; test asserts enqueue + dry-run no-op + inactive skip.

backend/src/services/webhookService.js

@@ -210,6 +210,38 @@ function parseJsonField(value, fallback) {
   try { return JSON.parse(value) ?? fallback; } catch { return fallback; }
 }
 
+/**
+ * Enqueue a delivery for ONE specific active webhook subscription, bypassing the
+ * event-type subscription matching that `fire` does. Used by the workflow engine
+ * `webhook` action: the flow author picks a configured webhook (which carries
+ * the URL + signing secret + create-time URL validation), and the delivery then
+ * rides the SAME worker pipeline as every other webhook — per-delivery SSRF
+ * re-validation, HMAC signing, retries/backoff and the audit log, all for free.
+ * Never throws. Returns { enqueued, reason?, deliveryId? }.
+ */
+async function enqueueForWebhook(webhookId, eventType, data) {
+  try {
+    const w = await db('webhooks').where({ id: webhookId, active: true }).first();
+    if (!w) return { enqueued: false, reason: 'webhook not found or inactive' };
+    const now = new Date();
+    const deliveryUuid = crypto.randomUUID();
+    const envelope = { id: deliveryUuid, type: eventType, created_at: now.toISOString(), data };
+    await db('webhook_deliveries').insert({
+      webhook_id: w.id,
+      event_type: String(eventType).slice(0, 64),
+      payload: JSON.stringify(envelope),
+      attempt_count: 0,
+      status: 'pending',
+      next_retry_at: now,
+      created_at: now,
+    });
+    return { enqueued: true, webhookId: w.id, deliveryId: deliveryUuid };
+  } catch (err) {
+    logger.error(`[webhookService.enqueueForWebhook] failed for #${webhookId}: ${err.message}`);
+    return { enqueued: false, reason: err.message };
+  }
+}
+
 /**
  * Canonical event sub-object for outbound webhooks (#341). Always returns
  * the full key set so receivers don't have to handle "field missing vs
@@ -235,6 +267,7 @@ function buildEventSubject(input = {}) {
 
 module.exports = {
   fire,
+  enqueueForWebhook,
   generateSecret,
   signPayload,
   verifySignature,

backend/src/services/workflows/actions.js

@@ -179,25 +179,21 @@ registry.registerAction('notify_pre_event', async (ctx) => {
   return res;
 });
 
-// Call an external webhook (the `webhook` node type + the "Call a webhook"
-// action both resolve here). POSTs the run context to config.url. SSRF-guarded
-// via validateExternalUrl — the same NAT64/private-range protection the webhook
-// delivery worker uses — unless WEBHOOK_ALLOW_PRIVATE_URLS=true (local-dev
-// opt-out). No redirects. Best-effort: a rejected URL / network error records an
-// observable skipped step rather than throwing the run.
+// Call a webhook (the `webhook` node type + the "Call a webhook" action both
+// resolve here). The flow author picks a CONFIGURED webhook subscription
+// (config.webhookId, managed in Settings → Webhooks); this enqueues a real
+// delivery for it, so it rides the same worker pipeline as every other webhook:
+// per-delivery SSRF re-validation (validateExternalUrl / GHSA-wmjx-pc37-272r),
+// HMAC signing with the subscription's secret, retries/backoff, and the audit
+// log — all inherited, nothing reimplemented. Best-effort: an unset / missing /
+// inactive webhook records an observable skipped step.
 registry.registerAction('webhook', async (ctx) => {
-  const url = ctx.node.config?.url;
-  if (!url) return { skipped: true, reason: 'no webhook url configured' };
-  if (ctx.vars?.__dryRun) return { dryRun: true, would: 'webhook', url };
+  const webhookId = ctx.node.config?.webhookId ? Number(ctx.node.config.webhookId) : null;
+  if (!webhookId) return { skipped: true, reason: 'no webhook selected (pick one in Settings → Webhooks)' };
+  if (ctx.vars?.__dryRun) return { dryRun: true, would: 'webhook', webhookId };
 
-  if (process.env.WEBHOOK_ALLOW_PRIVATE_URLS !== 'true') {
-    const { validateExternalUrl } = require('../../utils/networkValidation');
-    const check = validateExternalUrl(url);
-    if (!check.valid) return { skipped: true, reason: `url rejected: ${check.error}` };
-  }
-
-  const axios = require('axios');
-  const body = {
+  const eventType = `workflow.${ctx.run.trigger_event || 'webhook'}`;
+  const res = await require('../webhookService').enqueueForWebhook(webhookId, eventType, {
     workflow: { id: ctx.run.workflow_id, version: ctx.run.version },
     run: {
       id: ctx.run.id,
@@ -206,18 +202,10 @@ registry.registerAction('webhook', async (ctx) => {
       entity_id: ctx.run.entity_id,
     },
     vars: ctx.vars || {},
-  };
-  try {
-    const res = await axios.post(url, body, {
-      headers: { 'Content-Type': 'application/json', 'User-Agent': 'PicPeak-Workflows/1.0', 'X-PicPeak-Event': ctx.run.trigger_event || '' },
-      timeout: parseInt(process.env.WEBHOOK_HTTP_TIMEOUT_MS || '10000', 10),
-      maxRedirects: 0, // no redirects — SSRF + receivers should give a final URL
-      validateStatus: () => true,
-    });
-    return { webhook_posted: url, status: res.status };
-  } catch (err) {
-    return { skipped: true, reason: `webhook request failed: ${err.message}` };
-  }
+  });
+  return res.enqueued
+    ? { webhook_enqueued: res.webhookId, deliveryId: res.deliveryId }
+    : { skipped: true, reason: res.reason };
 });
 
 // Create/prepare-document actions — registered so flows referencing them are