Initial WebhookServer implementation

Add the .NET 8 solution scaffolded against PLAN.md. Three projects share
WebhookServer.Core (models, auth, execution, storage, IPC, callbacks)
and WebhookServer.Service hosts an embedded Kestrel listener plus the
named-pipe admin server. WebhookServer.Gui is a thin MVVM client over
the pipe. Includes 25 unit tests covering HMAC verification, bearer
auth, IP allowlist parsing, arg-template rendering, DPAPI round-trip,
and the encrypt-on-save config store.

Install/uninstall PowerShell scripts default to LocalSystem and accept
a domain user or gMSA via -ServiceAccount.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/WebhookServer.Core.Tests/BearerVerifierTests.cs

@@ -0,0 +1,27 @@
+using WebhookServer.Core.Auth;
+using Xunit;
+
+namespace WebhookServer.Core.Tests;
+
+public class BearerVerifierTests
+{
+    [Fact]
+    public void Accepts_correct_token() =>
+        Assert.True(BearerVerifier.Verify("Bearer s3cret", "s3cret").Success);
+
+    [Fact]
+    public void Rejects_wrong_token() =>
+        Assert.False(BearerVerifier.Verify("Bearer nope", "s3cret").Success);
+
+    [Fact]
+    public void Rejects_missing_header() =>
+        Assert.False(BearerVerifier.Verify(null, "s3cret").Success);
+
+    [Fact]
+    public void Rejects_non_bearer_scheme() =>
+        Assert.False(BearerVerifier.Verify("Basic s3cret", "s3cret").Success);
+
+    [Fact]
+    public void Rejects_when_server_secret_empty() =>
+        Assert.False(BearerVerifier.Verify("Bearer s3cret", "").Success);
+}