fix: require env vars, no defaults

feat: add HMAC-SHA256 signature verification for CVAT webhooks

fix: strip env vars to prevent trailing whitespace

fix: stream subprocess output in real-time

fix: add clone logging and timeout

fix: set GIT_TERMINAL_PROMPT=0 to prevent clone hanging

debug: add test-clone endpoint

debug: show PAT prefix in health

debug: add secret check to health endpoint

fix: pre-install deps in Docker, skip runtime pip install

init