feat: filter webhooks per project, board, and account

Adds optional project, board, and acting-user scope to each webhook so
events from a specific board or project can be routed to a single
endpoint without an external automation tool in the middle (closes
#1457).

A webhook now fires for an event only when every set scope matches:
empty scope still means "fire for everything", keeping existing
webhooks working unchanged. Scope filtering is centralized in the
sendWebhooks helper, which auto-derives projectId/boardId from the
event payload, so existing call sites are untouched.

server/api/controllers/webhooks/update.js

@@ -27,6 +27,21 @@
  *           schema:
  *             type: object
  *             properties:
+ *               projectId:
+ *                 type: string
+ *                 nullable: true
+ *                 description: Optional project scope
+ *                 example: "1357158568008091264"
+ *               boardId:
+ *                 type: string
+ *                 nullable: true
+ *                 description: Optional board scope
+ *                 example: "1357158568008091264"
+ *               userId:
+ *                 type: string
+ *                 nullable: true
+ *                 description: Optional acting-user scope
+ *                 example: "1357158568008091264"
  *               name:
  *                 type: string
  *                 maxLength: 128
@@ -91,6 +106,18 @@ module.exports = {
       ...idInput,
       required: true,
     },
+    projectId: {
+      ...idInput,
+      allowNull: true,
+    },
+    boardId: {
+      ...idInput,
+      allowNull: true,
+    },
+    userId: {
+      ...idInput,
+      allowNull: true,
+    },
     name: {
       type: 'string',
       isNotEmptyString: true,
@@ -136,7 +163,7 @@ module.exports = {
       throw Errors.WEBHOOK_NOT_FOUND;
     }
 
-    const values = _.pick(inputs, ['name', 'url', 'accessToken']);
+    const values = _.pick(inputs, ['projectId', 'boardId', 'userId', 'name', 'url', 'accessToken']);
     const events = inputs.events && inputs.events.split(',');
     const excludedEvents = inputs.excludedEvents && inputs.excludedEvents.split(',');