Add webhooks signing helpers, local receiver, and tango CLI

[makegov-mark]

Summary

Adds a complete webhook tooling surface to tango-python for developers building integrations against the Tango API — signing helpers, a local receiver class, a command-line tool, and management commands for the underlying endpoints and subscriptions.

A dev with TANGO_API_KEY can now go from zero to receiving real Tango deliveries entirely from the shell, and can develop / test their handler offline with no Tango involvement at all.

What ships

tango.webhooks subpackage

• Signing helpers (pure stdlib, no extras required): verify_signature, generate_signature, parse_signature_header. Mirrors the canonical Tango server scheme (X-Tango-Signature: sha256=<hex> HMAC-SHA256 over raw body) byte-for-byte.
• WebhookReceiver — context-manager-friendly local HTTP receiver for tests and development. Verifies signatures, optional forward_to mirroring, in-memory delivery history with cap, optional on_delivery callback. Returns JSON error bodies ({"ok": false, "error": "invalid_signature"}) instead of stdlib HTML pages.
• simulate.sign(payload, secret) -> SignedRequest — produce the exact wire form a Tango delivery would have. Useful in pytest fixtures.
• simulate.deliver(...) — sign and POST to a target URL.

tango[webhooks] extra

A new optional extra (`pip install 'tango-python[webhooks]'`, adds `click`) installs a `tango` console script with the full webhook lifecycle:

```bash

Discovery

tango webhooks list-event-types
tango webhooks fetch-sample --event-type entities.updated

Local development

tango webhooks listen --port 8011 --secret $SECRET
tango webhooks simulate --secret $SECRET --event-type entities.updated # sign+print
tango webhooks simulate --secret $SECRET --event-type entities.updated
--to http://127.0.0.1:8011/tango/webhooks # also POST

Configuration (the piece that previously required dropping into Python)

tango webhooks endpoints create|list|get|delete
tango webhooks subscriptions create|list|get|delete

Real end-to-end test

tango webhooks trigger
```

Documentation

• New `docs/WEBHOOKS.md` — single comprehensive guide: install, concepts, zero-to-receiving quickstart, full CLI reference, and programmatic patterns for `WebhookReceiver` / `simulate.sign` / `simulate.deliver` in pytest. Troubleshooting appendix.
• `docs/API_REFERENCE.md` — filled in `get_webhook_subscription` (was missing), replaced the inline hand-rolled HMAC snippet with a pointer to `tango.webhooks.verify_signature`, added a new "Webhook tooling" section cataloging every importable from the new subpackage.
• `README.md` — new "Webhook Tooling" section under Advanced Features; new guide linked from the Documentation index.

Why

Devs integrating Tango webhooks shouldn't have to clone the Tango server repo to find a test harness. The tooling that lived in `tango/tools/webhook_lab/` was already half-duplicating SDK calls (`client.py` reimplemented `/api/webhooks/subscriptions/`); putting the tooling alongside the SDK lets it use the SDK directly and ships a cohesive integration story for partner developers.

Test plan

• `uv run pytest tests/test_webhooks_*.py` — 35 new tests pass
• Full unit suite green on macOS / Linux / Windows × Python 3.12 / 3.13 (CI confirmed)
• `uv run mypy tango/webhooks/` — clean
• `uv run ruff check tango/webhooks/ tests/test_webhooks_*.py` — clean
• Coverage on new code: signing 100%, receiver 96%, simulate 94%
• Empirically verified `listen` / `simulate` / round-trip / JSON error bodies / forwarding chain end-to-end

Scope notes / decisions to confirm

• Console script name `tango`. Clean and short, but `tango-scripts` reuses the bare name elsewhere in the org. Flagged in CHANGELOG as revisitable before release. If you'd rather lock in `tango-cli` or `tango-webhooks`, this is the easy moment.
• No browser UI. The `webhook_lab` HTML/templates/static did not migrate. Headless CLI + in-memory `deliveries` list cover the testing use case. The lab in `tango/` can stay or be retired — not touched in this PR.
• The lab's `client.py` in `tango/` still duplicates SDK methods. Recommended follow-up: either delete the lab or refactor it to depend on `tango-python`. Out of scope here.
• Server-side relay (so `listen` can work without external tunneling tools) intentionally not attempted. Existing tunneling tools cover the use case; a relay would need server-side work in `tango/`.
• `subscriptions create` is single-record only for now — multi-record needs a `--config-file` option or a more elaborate flag scheme. The Python SDK's `create_webhook_subscription` accepts arbitrary payloads.
• No `update` commands in the CLI. Endpoints/subscriptions are usually delete-and-recreate during dev, and partial-update semantics get awkward via flags.

Risks

• New public API surface (`tango.webhooks.*`, top-level re-exports). Per CLAUDE.md these are now contract — renames need deprecation aliases.
• Adds an optional dependency (`click`); base install unchanged.
• The `tango` console script name is global — see the scope note above.

Next steps

• Decide console script name before the next release.
• Follow-up PR in `tango/` to retire or refactor `tools/webhook_lab/`.
• Possible follow-up: lift the workflow guide section out of `docs/WEBHOOKS.md` into the public mkdocs site (`makegov/docs`) once the API surface settles.

MAKEGOV_BOT_SIGNATURE