feat(receiver): storage layer and webhook payload compat

Dual-dialect store (SQLite via modernc.org, MySQL via go-sql-driver,
both pure Go) with order-tolerant start/complete upserts, filtered and
paginated listing, and aggregate queries (per-day, top domains, query
types, statuses, duration percentiles, top clients). Sender gains
optional EXPLOREDNS_WEBHOOK_TOKEN bearer auth; a round-trip test pins
receiver structs byte-compatible with the sender payloads.

Note: go directive moves to 1.25.0, required by modernc.org/sqlite.
CI reads the version from go.mod so GOTOOLCHAIN=local stays satisfied.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

web/api/handler.go

@@ -276,7 +276,7 @@ func newHandler(ctx context.Context) *Handler {
 		maxRunning: envInt("EXPLOREDNS_MAX_JOBS", defaultMaxRunningJobs),
 		version:    "dev",
 		limiter:    newRateLimiter(limit, window),
-		webhook:    newWebhookReporter(os.Getenv("EXPLOREDNS_WEBHOOK_URL")),
+		webhook:    newWebhookReporter(os.Getenv("EXPLOREDNS_WEBHOOK_URL"), os.Getenv("EXPLOREDNS_WEBHOOK_TOKEN")),
 		fp:         fingerprint.New(),
 	}