feat(notifier): DOC-001 — wire the orphan webhook notifier; README "6 notifiers" now accurate

Acquisition-audit DOC-001 closure (Sprint 7 ACQ, 2026-05-16). The
webhook notifier shipped to internal/connector/notifier/webhook/
months ago with full SafeHTTPDialContext SSRF guard + HMAC-SHA256
signing + comprehensive tests, but it was never wired in
cmd/server/main.go — README:39 claimed "6 notifiers" while only 5
were actually registered. Audit prompt offered two paths: (a) wire
it if the impl is feature-complete, (b) fix the README count. The
impl IS feature-complete (verified by reading webhook.go +
webhook_test.go), so path (a) is the rigorous closure.

What this commit adds
=====================

internal/connector/notifier/webhook/adapter.go (NEW):
  NotifierAdapter bridges the rich notifier.Connector interface
  (SendAlert / SendEvent / ValidateConfig) to the simpler service-
  layer service.Notifier (Send + Channel) used by the notification
  service's per-channel routing. Send(ctx, recipient, subject,
  body) constructs a notifier.Event with the three fields populated
  + a fresh 16-byte hex random ID + UTC timestamp, delegates to
  the Connector's SendEvent. Channel() returns "webhook". The
  Connector's per-request HMAC-SHA256 signing + SafeHTTPDialContext
  SSRF guard apply transitively through SendEvent → postWebhook
  — no defense duplication at the adapter layer.

internal/config/notifiers.go:
  NotifierConfig gains WebhookURL + WebhookSecret fields with the
  same docstring shape as the other 5 notifier env-var pairs.

internal/config/config.go::Load():
  Reads CERTCTL_WEBHOOK_URL + CERTCTL_WEBHOOK_SECRET (both empty
  by default → notifier disabled, matching the pattern of the
  other 5 env-var-gated notifiers).

cmd/server/main.go:
  - notifywebhook import added next to the other 5.
  - New wire-up block after the OpsGenie one: when WebhookURL is
    set, constructs the Connector via webhook.New (production
    constructor — strict ValidateSafeURL + SafeHTTPDialContext),
    wraps in NotifierAdapter, registers as notifierRegistry["Webhook"].
    Boot log includes the signing posture ("HMAC-SHA256 signed"
    vs "unsigned") so operators can spot a missing secret.

Target-connector count reconciliation
=====================================

The audit prompt also asked to reconcile the target-connector
count (README says "fourteen + Kubernetes Secrets preview" = 15;
ls internal/connector/target/ shows 17 dirs). Ground-truth: the
extra two dirs (certutil, configcheck) are shared HELPER packages
(PEM/PFX conversion + server-side shell-injection validation
respectively), NOT target connectors. Real target-connector count
is 17 - 2 = 15, exactly matching README:12 + README:39. No README
change needed.

Verified locally: gofmt clean, go vet clean, staticcheck clean
across internal/config + internal/connector/notifier/webhook +
cmd/server; `go test -count=1
./internal/connector/notifier/webhook/...` green (existing tests
unchanged); `go test -short -count=1 ./internal/config/...
./cmd/server/...` green; `go build ./cmd/server` produces a
30.9MB binary that boots.

internal/config/config.go

@@ -613,6 +613,12 @@ func Load() (*Config, error) {
 			SMTPPassword:        getEnv("CERTCTL_SMTP_PASSWORD", ""),
 			SMTPFromAddress:     getEnv("CERTCTL_SMTP_FROM_ADDRESS", ""),
 			SMTPUseTLS:          getEnvBool("CERTCTL_SMTP_USE_TLS", true),
+			// Acquisition-audit DOC-001 closure (Sprint 7 ACQ, 2026-05-16).
+			// Wire the previously-orphan webhook notifier
+			// (internal/connector/notifier/webhook/) into the boot
+			// path. Empty WebhookURL = notifier disabled.
+			WebhookURL:    getEnv("CERTCTL_WEBHOOK_URL", ""),
+			WebhookSecret: getEnv("CERTCTL_WEBHOOK_SECRET", ""),
 		},
 		NetworkScan: NetworkScanConfig{
 			Enabled:      getEnvBool("CERTCTL_NETWORK_SCAN_ENABLED", false),

internal/config/notifiers.go

@@ -83,4 +83,28 @@ type NotifierConfig struct {
 	// Default: true. Set to false for plain SMTP (not recommended).
 	// Setting: CERTCTL_SMTP_USE_TLS environment variable.
 	SMTPUseTLS bool
+
+	// WebhookURL is the HTTP(S) endpoint for the generic webhook
+	// notifier. Acquisition-audit DOC-001 closure (Sprint 7 ACQ,
+	// 2026-05-16). When set, the cmd/server/main.go boot path
+	// constructs an internal/connector/notifier/webhook.Connector
+	// (full SafeHTTPDialContext SSRF guard + ValidateSafeURL pre-
+	// flight + HMAC-SHA256 signing) wrapped in NotifierAdapter so
+	// the simpler service.Notifier (Send + Channel) interface used
+	// by the notification service receives a "webhook" channel
+	// registration. Pre-Sprint-7 the impl existed in the tree but
+	// was unwired — README claimed "6 notifiers" while only 5
+	// were registered. Optional: leave empty to disable.
+	// Setting: CERTCTL_WEBHOOK_URL environment variable.
+	WebhookURL string
+
+	// WebhookSecret is the HMAC-SHA256 shared secret used by the
+	// webhook notifier to sign every outbound HTTP POST in the
+	// X-Webhook-Signature header. The receiver verifies the signature
+	// against the SAME secret before trusting the payload — without
+	// this guard, any host that can reach the operator's webhook
+	// endpoint could spoof certctl notifications. Optional but
+	// strongly recommended; empty disables signing (operator-
+	// acknowledged unsigned mode). Setting: CERTCTL_WEBHOOK_SECRET.
+	WebhookSecret string
 }