v5.0.0

Sources can now be onboarded and removed over the API: POST /sources creates one, returns its secret once with the webhook path and signing snippets, and the source can post immediately, while DELETE /sources/{source} closes the webhook again and leaves environment sources read only. GET /ops/overview answers the questions an on-call rotation asks first in one round trip: counters per source, queue depth and breaker state per destination, the deliveries sitting in failed with their last error, the last replay and how it ended, and the last smoke result. The delivery list became a search: status lists, event key, idempotency key, status code, replays only, an error substring, a since and until window, ascending or descending order and stable paging. Smoke runs report their own totals to POST /ops/smoke, backed by a new smoke_runs table in Alembic 0004, so a deployment can be asked when it was last checked. The suite is 141 tests, up from 128, and make demo reads the overview back and compares it against /stats.