feat: add async /jobs surface, state webhooks, and artifact handling

Add the async job submission API, webhook state notifications, and
artifact serving endpoints on top of the Phase 3 queue infrastructure.

Key changes:
- POST /jobs: async job submission with 202 + job_id ULID; optional
  state_webhook_url for push notifications on state transitions
- GET /jobs/{id}: job status polling with result, error, and artifact
  metadata; artifacts <= 256KB inlined, larger ones by URL reference
- GET /jobs/{id}/artifacts/{name}: raw artifact data serving
- Webhook dispatcher: at-least-once delivery with exponential backoff
  (5 retries); optional HMAC-SHA256 signing (X-Foreman-Signature)
- ADR-0014: state_webhook_url only honored on POST /jobs, not sync
  /api/chat (caller already blocks for result)
- Comprehensive tests for /jobs lifecycle, webhook delivery, HMAC
  verification, artifact inline/URL threshold, and TTL pruning

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.env.example

@@ -24,3 +24,9 @@ FOREMAN_POLL_INTERVAL=30s
 
 # Optional HMAC key for signing webhook payloads (ADR-0005)
 FOREMAN_WEBHOOK_SECRET=
+
+# Maximum retry attempts for a job before marking as failed (default: 3)
+FOREMAN_MAX_ATTEMPTS=3
+
+# How long to retain completed/failed jobs before pruning (default: 24h)
+FOREMAN_JOB_TTL=24h