Webhook delivery system for merchant loan status changes

[Josue19-08]

🔖 Title

Webhook delivery system for merchant loan status changes

---

📄 Description

Merchants currently have no way to be notified programmatically when a loan status changes for their customers. There is no webhook infrastructure in the repo — the only existing reference to "webhook" is an inbound KYC provider webhook, unrelated to outbound merchant notifications.

---

✅ Tasks to complete

• Migration: webhook endpoint registration table (merchant, url, secret, active events)
• Endpoint registration CRUD (merchant-facing)
• BullMQ delivery queue with exponential backoff retry
• HMAC signature generation/verification for payloads
• Delivery log table (status, attempts, response code)
• Admin endpoints to inspect/manage webhook subscriptions and delivery logs
• Trigger delivery on loan status change events
• Unit tests for signing, retry logic, and queue processor
• Integration tests covering full delivery + retry flow
• Swagger documentation

---

📚 Documentation/context for AI

(This link never should removed)
https://github.com/TrustUp-app/TrustUp-API/tree/main/docs

---

🗒️ Additional notes

No outbound webhook infrastructure exists in the codebase — this is entirely new.