Phase 13: integrations (research folder, git, Prometheus, signed webhooks)

Adds the integration layer that turns external sources into provenance-tagged
observations without ever executing what it reads.

- research folder poller: os.OpenRoot, text allowlist, binary/archive/symlink
  rejection, content fingerprints, duplicate tracking
- git poller: bare shallow mirror with hooks disabled and ext protocol refused,
  commit observations, co-change pairs
- Prometheus poller: threshold crossings and relative-change detection
- webhooks: HMAC over timestamp.body, +/-300s window, replay cache, 256 KiB cap,
  per-IP rate limit; refused entirely without a secret
- capabilities read_metrics (allow) and repository.read (ask), scoped to the
  invoking mind's integrations
- migrations 0013, API, UI pages, noemactl integrations, docs/integrations.md

internal/api/server.go

@@ -7,18 +7,21 @@ import (
 
 	"github.com/andydixon/noema/internal/app"
 	"github.com/andydixon/noema/internal/auth"
+	"github.com/andydixon/noema/internal/integrations"
 )
 
 // Server composes the API routes, the web UI and the middleware chain.
 type Server struct {
-	deps app.Deps
-	mux  *http.ServeMux
+	deps           app.Deps
+	mux            *http.ServeMux
+	replays        *integrations.ReplayCache
+	webhookLimiter *ipBucket
 }
 
 // New builds the server. ui registers the HTML routes on the same mux so that
 // a single middleware chain (auth, CSRF, headers, limits) covers both.
 func New(deps app.Deps, ui interface{ Register(*http.ServeMux) }) *Server {
-	s := &Server{deps: deps, mux: http.NewServeMux()}
+	s := &Server{deps: deps, mux: http.NewServeMux(), replays: integrations.NewReplayCache(), webhookLimiter: newIPBucket(120, 60)}
 	s.routes()
 	if ui != nil {
 		ui.Register(s.mux)
@@ -64,6 +67,7 @@ func (s *Server) routes() {
 	s.cognitionRoutes()
 	s.graphRoutes()
 	s.capabilityRoutes()
+	s.integrationRoutes()
 
 	m.HandleFunc("/api/", func(w http.ResponseWriter, r *http.Request) {
 		writeError(w, r, http.StatusNotFound, "not_found", "no such endpoint")