Receive a GitLab CI webhook, verify token, and create ci-fix tasks.

Handles the following event types:

• pipeline (failed) - creates a ci-fix task, capped at MAX_CI_RETRIES active attempts per branch.
• job (failed) - creates a ci-fix task for the specific job.

Reads GITLAB_WEBHOOK_TOKEN from environment. GitLab sends a simple plaintext token in the x-gitlab-token header. Returns 200 on success, 401 on bad/missing token.