Add Storage, Users, Secrets, Webhooks, Scheduled tasks, Audit log screens

Full management surfaces for the platform-admin tenant, mirroring the
existing Tenants pattern (DataTable + row actions + create/edit dialogs +
ConfirmDialog for destructive ops, all data-action tagged for the
command bus, useRegisterAdminContext publishing for the assistant).

- Storage (/storage): backends + credentials. Write-only secret fields,
  Validate/Activate/Deactivate/Set-default/Mark-degraded/Maintenance.
- Users (/users): tabs for Users, Invitations, Roles. Per-user View
  drawer with profile, role add/remove, API keys (one-time reveal on
  create), usage + quota.
- Secrets (/secrets): /api/v1/admin/secrets — create/rotate/rollback,
  versions dialog, enable/disable, generate-value helper.
- Webhooks (/webhooks): CRUD, pause/resume, regenerate-secret with
  one-time reveal, send test event, deliveries dialog.
- Scheduled tasks (/scheduled-tasks): cron CRUD, run-now trigger,
  enable/disable, expandable run history.
- Audit log (/activity): replaces the empty stub. Filter by severity,
  resource type, date range; click for full JSON detail.

All endpoints are hand-rolled HTTP because most aren't covered by the
generated OpenAPI typed paths yet — switch to arcadia.typed.* when the
backend wires them into OpenApiSpex.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

app/lib/arcadia/webhooks.ts

@@ -0,0 +1,161 @@
+// Outbound webhook helpers.
+// Backend: /api/v1/webhooks (CRUD + pause/resume/regenerate-secret/deliveries/stats/test).
+
+import type { ArcadiaClient } from "@crema/arcadia-client"
+
+export type WebhookStatus = "active" | "paused" | "disabled"
+export type WebhookRetryStrategy = "linear" | "exponential"
+
+export interface Webhook {
+  id: string
+  tenant_id: string
+  url: string
+  description: string | null
+  status: WebhookStatus
+  events: string[]
+  headers: Record<string, string>
+  max_retries: number
+  retry_strategy: WebhookRetryStrategy
+  last_triggered_at: string | null
+  success_count: number
+  failure_count: number
+  /** Only populated on create / regenerate-secret responses. */
+  secret?: string | null
+  inserted_at: string
+  updated_at: string
+}
+
+export interface WebhookInput {
+  url: string
+  description?: string | null
+  events?: string[]
+  headers?: Record<string, string>
+  max_retries?: number
+  retry_strategy?: WebhookRetryStrategy
+}
+
+export interface WebhookDelivery {
+  id: string
+  webhook_endpoint_id: string
+  event_type: string
+  status: "pending" | "delivered" | "failed" | string
+  attempt: number
+  request_url: string
+  request_headers: Record<string, string>
+  response_status: number | null
+  response_time_ms: number | null
+  error_message: string | null
+  sent_at: string | null
+  completed_at: string | null
+  next_retry_at: string | null
+  inserted_at: string
+}
+
+export interface WebhookStats {
+  success_rate: number
+  delivery_count: number
+  failure_count: number
+  avg_response_time_ms: number
+  [key: string]: unknown
+}
+
+export async function listWebhooks(arcadia: ArcadiaClient): Promise<Webhook[]> {
+  const res = await arcadia.GET<{ data: Webhook[] }>("/api/v1/webhooks")
+  return res.data
+}
+
+export async function getWebhook(arcadia: ArcadiaClient, id: string): Promise<Webhook> {
+  const res = await arcadia.GET<{ data: Webhook }>(`/api/v1/webhooks/${id}`)
+  return res.data
+}
+
+export async function createWebhook(
+  arcadia: ArcadiaClient,
+  input: WebhookInput,
+): Promise<Webhook> {
+  const res = await arcadia.POST<{ data: Webhook }>("/api/v1/webhooks", {
+    body: { webhook_endpoint: input },
+  })
+  return res.data
+}
+
+export async function updateWebhook(
+  arcadia: ArcadiaClient,
+  id: string,
+  input: Partial<WebhookInput>,
+): Promise<Webhook> {
+  const res = await arcadia.PATCH<{ data: Webhook }>(`/api/v1/webhooks/${id}`, {
+    body: { webhook_endpoint: input },
+  })
+  return res.data
+}
+
+export async function deleteWebhook(arcadia: ArcadiaClient, id: string): Promise<void> {
+  await arcadia.DELETE(`/api/v1/webhooks/${id}`)
+}
+
+export async function pauseWebhook(arcadia: ArcadiaClient, id: string): Promise<Webhook> {
+  const res = await arcadia.POST<{ data: Webhook }>(`/api/v1/webhooks/${id}/pause`)
+  return res.data
+}
+
+export async function resumeWebhook(arcadia: ArcadiaClient, id: string): Promise<Webhook> {
+  const res = await arcadia.POST<{ data: Webhook }>(`/api/v1/webhooks/${id}/resume`)
+  return res.data
+}
+
+export async function regenerateWebhookSecret(
+  arcadia: ArcadiaClient,
+  id: string,
+): Promise<Webhook> {
+  const res = await arcadia.POST<{ data: Webhook }>(
+    `/api/v1/webhooks/${id}/regenerate-secret`,
+  )
+  return res.data
+}
+
+export async function listWebhookDeliveries(
+  arcadia: ArcadiaClient,
+  id: string,
+  params?: { limit?: number; offset?: number },
+): Promise<WebhookDelivery[]> {
+  const res = await arcadia.GET<{ data: WebhookDelivery[] }>(
+    `/api/v1/webhooks/${id}/deliveries`,
+    { params: params as Record<string, number | undefined> },
+  )
+  return res.data
+}
+
+export async function getWebhookStats(
+  arcadia: ArcadiaClient,
+  id: string,
+): Promise<WebhookStats> {
+  const res = await arcadia.GET<{ data: WebhookStats }>(
+    `/api/v1/webhooks/${id}/stats`,
+  )
+  return res.data
+}
+
+export async function testWebhook(
+  arcadia: ArcadiaClient,
+  id: string,
+): Promise<{ ok: boolean; message?: string; details?: unknown }> {
+  return arcadia.POST(`/api/v1/webhooks/${id}/test`)
+}
+
+// A starter list of platform events. Free-form by design — different deployments
+// emit different events. Users can type custom values.
+export const COMMON_WEBHOOK_EVENTS = [
+  "user.created",
+  "user.updated",
+  "user.deleted",
+  "tenant.created",
+  "tenant.updated",
+  "object.uploaded",
+  "object.deleted",
+  "secret.rotated",
+  "invitation.sent",
+  "invitation.accepted",
+  "scheduled_task.completed",
+  "scheduled_task.failed",
+]