docs/webhooks.md "Custom Webhooks" section promised that a webhook with
just `url = ...` set would POST a JSON payload to that URL — no custom
preset YAML required. The code rejected this: `loader.Load("")` returned
an error before any send code ran, and there was no bundled preset that
turned a bare URL into a working webhook. The doc snippet has been false
since the webhook system shipped.

Fixes #676 by:

- Adding a bundled `json-post` preset (middlewares/presets/json-post.yaml,
  embedded into the binary). url_scheme `{url}`, method POST,
  Content-Type application/json, body shaped as
  {job:{...}, execution:{...}, host:{...}, ofelia:{...}}. Stdout / stderr
  are truncated to 4000 chars to keep payloads modest. The optional
  `link` field is included when set.

- Adding `webhook-default-preset` global, *string-typed so unset-vs-set
  is unambiguous (same pattern as SaveConfig.RestoreHistory):
    nil          → bundled DefaultPresetName ("json-post")
    non-nil ""   → explicit opt-out; webhooks missing `preset` fail
    non-nil "X"  → operator's chosen fallback preset name
  Resolution happens at webhook attach time via
  WebhookGlobalConfig.EffectiveDefaultPreset(), so live INI reloads and
  label changes take effect on the next attach without restart.

- Wiring the fallback into NewWebhook: when config.Preset == "", fill
  from loader.DefaultPreset() before Validate runs.

- Wiring the global through every existing seam: INI parse (gcfg),
  mapstructure, docker label allow-list (operator-tunable; not
  SSRF-sensitive — narrowing or widening the default cannot reach a new
  destination because the URL allow-list and preset loader still gate
  delivery), mergeWebhookGlobals (nil-check instead of sentinel-compare),
  applyGlobalWebhookLabels.

- Rewriting docs/webhooks.md "Custom Webhooks" to describe what now
  actually works, including the payload shape and the opt-out path.

Tests added:
- TestBundledPreset_JSONPostExists: preset embeds and validates.
- TestEffectiveDefaultPreset_ThreeIntents: nil / empty / explicit, plus
  nil-receiver safety.
- TestNewWebhook_URLOnly_UsesJSONPostFallback: end-to-end — url-only
  config attaches and the test server receives a valid JSON POST.
- TestNewWebhook_DefaultPresetOptOut: setting DefaultPreset=&"" restores
  the pre-fallback "either preset or url" error path.

Signed-off-by: Sebastian Mendel <[email protected]>

Five review comments + codecov/patch failure (61% on diff, target 80%).

Code/comment fixes:
- middlewares/webhook.go: NewWebhook now returns an explicit error when
  loader is nil instead of dereferencing nil later. The "loader may be
  nil in tests" comment was wrong — the function unconditionally calls
  loader.Load() further down.
- cli/config_webhook.go: stale doc comment said the default was
  "generic"; now references middlewares.DefaultPresetName ("json-post")
  consistently with the rest of the code and the docs.

Doc fixes (docs/webhooks.md):
- INI-vs-labels note rewritten: webhook-default-preset is now also
  label-accepted; webhook-preset-cache-ttl already had label support
  (the "not yet implemented" claim was stale since #640).
- Content-Type aligned with the preset YAML: application/json; charset=utf-8.
- Opt-out wording clarified: with the fallback disabled, every webhook
  must declare preset explicitly — `url = ...` alone does NOT help,
  since `url` only overrides the preset's url_scheme.

Coverage (codecov/patch fail → fix):
- cli/TestApplyGlobalWebhookLabels_DefaultPreset: 4 sub-tests covering
  missing label / empty (opt-out) / custom value / non-string ignored.
- cli/TestMergeWebhookGlobals_DefaultPreset: 5 sub-tests covering all
  combinations of nil-vs-set on dst/src, plus explicit-INI-wins-over-label.
- middlewares/TestNewWebhook_DefaultPresetCustom: operator's-choice arm
  of EffectiveDefaultPreset (was untested in isolation from the unit
  test on the accessor).
- middlewares/TestNewWebhook_ExplicitPresetWinsOverDefault: per-webhook
  `preset = X` overrides any global default — the fallback is only a
  fallback.
- middlewares/TestNewWebhook_NilLoaderReturnsError: pins the new
  nil-guard contract added in this commit.
- middlewares/TestJSONPostPreset_FailedExecutionRendersValidJSON:
  end-to-end on the FAILURE path with JSON-hostile chars (quotes,
  newlines, backslashes) in job name, command, and error. Asserts the
  body parses as JSON and the escaped fields round-trip cleanly. This
  is the real regression value — any future refactor of the json-post
  template that forgets to wrap a string field through the `json`
  helper will fail here.
- middlewares/TestJSONPostPreset_OutputTruncation: pins the documented
  4000-char truncation of stdout/stderr.

mergeWebhookGlobals + applyGlobalWebhookLabels + EffectiveDefaultPreset
+ PresetLoader.DefaultPreset are now all at 100% statement coverage.

Signed-off-by: Sebastian Mendel <[email protected]>

…e, DX

Six parallel reviewers (security, anti-pattern, continuity, DX, doc-
accuracy, test-completeness) ran against the initial #677 commit; this
commit lands everything that fits in the same PR plus follow-up issues
for what doesn't.

Correctness (security LOW + anti-pattern Critical):

- middlewares/preset.go: the `json` template helper now escapes every
  RFC 8259 control byte (U+0000-U+001F), not just \, ", \n, \r, \t. The
  earlier hand-rolled escape would pass through NUL, BEL, FF, terminal
  ESC (0x1b, the start of every ANSI sequence), and the rest unchanged
  — strict JSON parsers on the receiving end then rejected the body.
  Real trigger: any job emitting progress bars, ls --color output,
  pytest, make. Implementation moved to a dedicated jsonStringEscape
  function with full round-trip regression test in
  TestWebhookTemplateFuncs_JSON_RFC8259EscapeCoverage.

- middlewares/preset.go: the `truncate` helper is now rune-aware
  (utf8.RuneCountInString + range over s for the boundary). The
  byte-slice version would split multi-byte UTF-8 mid-rune when
  truncating non-ASCII output, producing a replacement rune that would
  combine with the json helper to break JSON parsing downstream.
  TestWebhookTemplateFuncs_Truncate now pins multi-byte emoji + ASCII
  mixes.

- Added a new `jsonRaw` template helper backed by encoding/json.Marshal
  for future presets that want to emit a fully-formed JSON value rather
  than a string interior.

Test e2e completeness (test-engineer review HIGH gaps):

- cli/docker_labels_test.go: three new tests exercise the full Docker-
  label pipeline (buildFromDockerContainers → applyGlobalWebhookLabels
  → mergeWebhookGlobals → InitManager → NewWebhook) — previously only
  the programmatic path was end-to-end tested.
    - TestURLOnlyWebhookFromLabels_UsesJSONPostFallback: url-only label
      config resolves to json-post.
    - TestCustomDefaultPresetViaLabel_AppliesToURLOnlyWebhook:
      operator-chosen default via label flows through to NewWebhook.
    - TestDefaultPresetOptOutViaLabel_FailsURLOnlyWebhook: explicit
      empty label captured as non-nil "" (opt-out) and attach fails
      with the new actionable error.

- middlewares/webhook_test.go: TestNewWebhook_URLOnly_UsesJSONPostFallback
  now asserts actual field VALUES in the JSON body (not just key
  presence) so a future template refactor that hard-codes a field fails
  loudly. Added TestJSONPostPreset_OptionalLinkBlock_RendersValidJSON
  exercising BOTH branches of the {{if .Preset.Link}} conditional —
  catches the comma-after-ofelia / no-trailing-comma landmine.

DX (DX reviewer findings 1-6):

- README.md: line 74 webhook description now mentions the url-only flow
  ("just `url = ...` to POST a JSON payload via the bundled `json-post`
  fallback"). The global-keys reference list around line 291 now
  documents `webhook-default-preset` alongside its siblings.

- docs/webhooks.md: Quick Start now LEADS with "Simplest case: just
  POST to a URL" (json-post fallback example) before the preset-based
  examples. The Docker-label reference table now lists
  `ofelia.webhook-default-preset`. Opt-out section explains the WHY
  (audit policy, ban-implicit-fallback, BYO-default) before the WHAT.

- middlewares/webhook.go: NewWebhook's opt-out error now names
  `webhook-default-preset` and the bundled fallback so operators can
  grep their way from a log line to the docs. The previous error
  ("either preset or url") didn't mention either knob.

Continuity / upgrade impact (continuity reviewer Important):

- CHANGELOG.md: [Unreleased] Added entry now LEADS with the
  upgrade-impact lede ("webhooks configured with `url = ...` but no
  `preset` were previously rejected at startup … they now attach and
  fire"). Operators reading release notes during upgrade see the
  behavior change first, the API details second.

Follow-up issues filed for the four out-of-scope findings:

- #678 — [global] unknown-key warning lacks "did you mean?" suggestion
  (parity with job-section path; pre-existing asymmetry).
- #679 — Local preset file silently shadowed by bundled name; warn on
  AddLocalPresetDir collision (pre-existing precedence; PR #677 makes
  it more likely because `json-post` is a generic-enough name).
- #673 (already open) — sendWithRetry's time.Sleep ignores ctx.
- #674 (already open) — rebuildAllMiddlewares allocates fresh
  *http.Client per webhook per reconcile.

Signed-off-by: Sebastian Mendel <[email protected]>

Two follow-up Copilot review comments on PR #677:

- middlewares/preset.go: DefaultPreset() godoc said the opt-out path
  fails attachment "when the per-webhook config also omits both
  `preset` and `url`". That was true before the actionable-error change
  in commit 57b4004 — now NewWebhook fails attachment whenever `preset`
  is empty after fallback, regardless of `url`, with the new error
  message that names `webhook-default-preset`. Comment now reflects the
  actual control-flow.

- middlewares/uncovered_ext_test.go: the regression-test comment
  pointed at "the parallel reviewer pass on #677" — accurate in
  isolation but #677 is the PR, not the canonical issue. Re-pointed at
  #676 (the issue tracking the json-post feature) so future readers can
  navigate from the test to the design discussion.

Signed-off-by: Sebastian Mendel <[email protected]>