Webhooks: fire an HMAC-signed HTTP POST to a webhook_url on file write events
(upload/delete/move/copy/mkdir/…) to connect FluxFiles to Zapier/Make/n8n.

- Event-driven = stateless: dispatched from the post-write hook, AFTER the response is
  flushed (fastcgi_finish_request) so a slow endpoint never adds to client latency;
  best-effort (a webhook failure never breaks the op).
- Payload {event,timestamp,user,disk,path,name} + X-FluxFiles-Signature: sha256=<hmac>.
- Claims allow_webhooks / webhook_url (http/s only, non-http dropped in Claims) /
  webhook_events (filter) / webhook_secret + isAllowed case; forwarded by
  embed/node/laravel/wordpress. SSRF-guarded with FLUXFILES_WEBHOOK_ALLOW_INTERNAL
  opt-out. POST /api/fm/webhooks/test ping. i18n webhook_not_configured/webhook_blocked
  ×16. docs/CONFIG.md. node 0.1.21.
- New FileManager wiring in index.php ($webhookDispatcher). The module ships in the
  private fluxfiles/webhooks package (gitignored); free core returns 501.

.claude/agents/: project subagents (spec-writer / coder / reviewer / tester), each
preloaded with FluxFiles conventions (module gate, JWT claims, i18n/config-doc guards,
security pitfalls) for a spec → code → test → review flow. They never commit/release.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>