Refactored to maintain a separate cloud version

Moves 12 packages from internal/ to pkg/ (config, id, validate, events, db,
auth, lifecycle, scheduler, channels, audit, service) so they can be imported
by the enterprise repo as a Go module dependency.

Introduces pkg/cpextension (shared Extension interface + ServerContext) and
pkg/cpserver (Run() entrypoint with functional options) so the enterprise
main.go can call cpserver.Run(cpserver.WithExtensions(...)) without duplicating
the 20-step server bootstrap. Adds db/migrations/embed.go for go:embed access
to OSS SQL migrations from the enterprise module.

cmd/control-plane/main.go is reduced to a 10-line wrapper around cpserver.Run.

pkg/channels/deliver.go

@@ -0,0 +1,36 @@
+package channels
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+
+	"github.com/containrrr/shoutrrr"
+
+	"git.omukk.dev/wrenn/wrenn/pkg/events"
+)
+
+// Deliver sends a notification to a single provider with the given config.
+// For webhooks it uses HMAC-signed HTTP POST; for all others it uses shoutrrr.
+func Deliver(ctx context.Context, provider string, config map[string]string, e events.Event) error {
+	payload, err := json.Marshal(e)
+	if err != nil {
+		return fmt.Errorf("marshal event: %w", err)
+	}
+
+	if provider == "webhook" {
+		wh := NewWebhookDelivery()
+		return wh.Deliver(ctx, config["url"], config["secret"], payload)
+	}
+
+	shoutrrrURL, err := ShoutrrrURL(provider, config)
+	if err != nil {
+		return fmt.Errorf("build shoutrrr URL: %w", err)
+	}
+
+	msg := FormatMessage(e)
+	if err := shoutrrr.Send(shoutrrrURL, msg); err != nil {
+		return fmt.Errorf("shoutrrr send: %w", err)
+	}
+	return nil
+}