feat(webhooks): add signature-verified GitHub webhook route

packages/backend/convex/githubSync.ts

@@ -503,6 +503,25 @@ export const syncForkWithUpstream = action({
   },
 });
 
+export const refreshSpoonById = internalAction({
+  args: { spoonId: v.id('spoons'), ownerId: v.id('users') },
+  handler: async (
+    ctx,
+    { spoonId, ownerId },
+  ): Promise<{ success: boolean; error?: string }> => {
+    try {
+      await refreshOwnedSpoon(ctx, ownerId, spoonId, 'scheduled_check');
+      return { success: true };
+    } catch (error) {
+      // Swallow so webhook fan-out never throws an unhandled rejection.
+      return {
+        success: false,
+        error: error instanceof Error ? error.message : String(error),
+      };
+    }
+  },
+});
+
 export const refreshDueSpoons = internalAction({
   args: { limit: v.optional(v.number()) },
   handler: async (