Align integration contract and image generation validation

docs/integrations/TICKTAR.md

@@ -17,8 +17,11 @@ Authorization: Bearer FRAME_FLOW_TOKEN. The bootstrap token is provided through
 client_id, name, permissions, enabled, created_at, last_used_at. Permissions:
 devices:read, images:read, images:delete, display:write, templates:read, render:write,
 jobs:read, jobs:write, history:read, settings:write, admin.
-0.1.0 seeds one admin token; provisioning scoped client rows is supported by middleware
-but multi-token management UI is not implemented. Use a trusted server-to-server
+The deployment token seeds an administrator. Administrators can create separate
+scoped clients through Connections or POST /api/v1/clients. The returned token is
+shown once; GET /api/v1/clients never returns tokens. DELETE /api/v1/clients/{id}
+revokes access. For Ticktar, grant devices:read, templates:read, render:write and
+display:write; add images:read or jobs permissions only when needed. Use a trusted server-to-server
 connection; CORS is opt-in by exact origins, never wildcard by default.
 
 ## Discovery and capabilities
@@ -86,13 +89,19 @@ The authenticated client is authoritative; source.client is optional metadata.
 History stores client_id/request_id/operation_id/device_id/action/result/timestamp.
 No internal endpoints, headers, stacks, paths or secrets are returned.
 
-## Future webhook
+## Webhooks
 
-SQLite events and webhook_subscriptions reserve operation.completed/failed,
-display.changed, device.online/offline/low_battery events. 0.1.0 emits operation/display
-events only; no callback delivery, retry worker or registration API is implemented.
-Future deliveries should use signed payloads and bounded retries.
-OAuth, tenancy, RBAC management and generated SDKs are future work.
+Administrators register callbacks through POST /api/v1/webhooks. Allowed public
+HTTPS hosts must be configured explicitly. Durable callbacks cover
+operation.completed, operation.failed, display.changed and observed
+device.online/device.offline/device.low_battery transitions. Device observation
+runs at most once per minute; failed cloud queries do not imply offline.
+
+X-Frame-Flow-Signature: sha256=<hex> is HMAC-SHA256 over the exact request body.
+Signing secrets are shown once and stored in mode-0600 files. Verify signatures
+and deduplicate event IDs. Delivery retries at most three times; events before
+registration are not replayed. Polling Operations remains available.
+OAuth, tenancy and generated SDKs are future work.
 
 ## Compatibility