fix(formatters): localize PR buttons, cap oversized content, dedupe status logic

- PR merge/close button labels now follow the group language (actions.merge/close)
  instead of hardcoded Chinese
- clamp content to Discord embed limits (title 256, description 4096, field value
  1024, 25 fields) in formatters plus a render-layer safety net; Telegram gets a
  tag-safe 4096-char cap (capHtml closes dangling tags)
- raise commit subject truncation from 72 to 200 chars (MAX_COMMIT_SUBJECT)
- extract workflowStatus/workflowRunStatus/statusColorKey helpers shared by
  check_run/check_suite/workflow_run/workflow_job
- dedupe deployment ref/sha fields via addDeploymentRefFields
- commit_comment without a commit id uses title_plain (no dangling ???????)
- tag pushes now report 'Tag created'; zh push title includes the {ref}
- sender profile link derives from the repo's forge origin instead of github.com
- group webhook log emoji injected via emojiPrefix, removed from locale files
- dispatchEvent accepts preloaded groups (single KV read per webhook)
- webhook 401 logs distinguish 'secret not configured' from 'invalid signature'

server/lib/webhook.ts

@@ -33,8 +33,8 @@ export async function processWebhook(
   tenantId?: string,
 ): Promise<WebhookResult> {
   let effectiveEnv = env;
+  const groups = await loadGroups(env.KV);
   if (tenantId) {
-    const groups = await loadGroups(env.KV);
     if (!groups.some((g) => g.id === tenantId)) {
       return { status: 404, body: { error: "Group not found" } };
     }
@@ -51,6 +51,17 @@ export async function processWebhook(
   }
 
   if (!(await provider.verify(body, headers, effectiveEnv))) {
+    // Log the actual cause: a missing provider secret is a deployment problem,
+    // while a mismatched signature usually means the sender used the wrong secret.
+    const secret =
+      provider.id === "gitea"
+        ? effectiveEnv.GITEA_WEBHOOK_SECRET
+        : effectiveEnv.GITHUB_WEBHOOK_SECRET;
+    if (!secret) {
+      log.warn({ provider: provider.id }, "Webhook rejected: provider secret is not configured");
+    } else {
+      log.warn({ provider: provider.id }, "Webhook rejected: invalid signature");
+    }
     return { status: 401, body: { error: "Invalid signature" } };
   }
 
@@ -108,7 +119,7 @@ export async function processWebhook(
     config.routes = config.routes.filter((r) => r.groupId === tenantId);
   }
 
-  const dispatch = dispatchEvent(config, event, env).catch((err) =>
+  const dispatch = dispatchEvent(config, event, env, groups).catch((err) =>
     log.error(err, "Dispatch failed"),
   );
   waitUntil(dispatch);