feat: enrich webhook payloads with downstream event table fields

Add missing fields (event_code, camera_ip, started_at, ended_at,
dwell_seconds, is_discarded, alerted_at, etc.) to both batch_event
and case_event payloads. Introduce source_id config for payload
injection and infer_camera_ip to extract IP from RTSP stream URL.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

tasks/lessons.md

@@ -0,0 +1,7 @@
+# Lessons
+
+- 2026-06-10: 远端接收端路由不能只凭已有相似服务或历史路径推断，必须先对用户指定的精确路径做真实 HTTP 探测，再决定配置值。
+  Prevention:
+  1. 对每个用户指定的 Webhook 路径，先在目标主机上用与真实请求接近的 `POST` 探测并记录状态码。
+  2. 如果存在多个相似路径，只能在验证过用户指定路径不可用后，才考虑回退到其它路径。
+  3. 切换远端配置前，先确认发送端容器对目标主机名或 IP 实际可达，避免写入不可解析的地址。

tasks/todo.md

@@ -28,3 +28,39 @@
 - Final verification passed:
   - `eval "$(/opt/homebrew/bin/pyenv init -)" && PYTHONPATH=src python -m unittest discover -s tests -v`
   - `cd web && pnpm install --frozen-lockfile && pnpm build`
+
+## Current Task: Webhook Payload Field Gap Check
+
+- [x] Pull the actual payload currently received by `video-recognition` and compare it against the required event list fields.
+- [x] Patch webhook payload builders to include the missing non-store fields required by the downstream table.
+- [x] Add or update focused webhook tests for the enriched payload shape.
+- [x] Run targeted verification and record the result here.
+
+### Current Findings
+
+- Current received payload only includes `batch_id`, `camera_id`, `event`, `kind`, `severity`, `source_id`, `state`, `ts`, `zone_id`, and `zone_label`.
+- Missing or not explicitly populated for the downstream event table: event code, camera IP, batch start time, removal time, dwell duration, discard flag, discard time, create time, alarm time, and update time.
+
+### Field Gap Verification
+
+- Actual receiver payload before the fix, from `video-recognition` result JSONL on `10.8.0.11`, confirmed only the base fields above and did not include the downstream table time/discard/IP fields.
+- Updated `src/cold_display_guard/webhooks.py` so both `batch_event` and `case_event` now include:
+  - `event_code`
+  - `camera_ip`
+  - `started_at`
+  - `ended_at`
+  - `removed_at`
+  - `dwell_seconds`
+  - `is_discarded`
+  - `discarded_at`
+  - `created_at`
+  - `alerted_at`
+  - `alarm_at`
+  - `updated_at`
+- `case_event` also now carries the missing contextual fields `camera_id`, `zone_id`, and `zone_label`.
+- Verification passed:
+  - `PYTHONPATH=src python3 -m unittest tests/test_webhooks.py -v`
+  - `PYTHONPATH=src python3 -m unittest tests/test_main.py -v`
+  - `PYTHONPATH=src python3 -m unittest discover -s tests -v`
+- Deployed updated code to `xiaozheng@10.8.0.11` without overwriting the remote `config/example.toml`, rebuilt `cold-display-guard:dev`, and restarted only `cold-display-guard-api` plus `cold-display-guard-runtime`.
+- Natural post-deploy traffic did not arrive during the 2-minute observation window, so final runtime verification used the deployed container to build representative batch/case webhook payloads with the live remote config and confirmed `camera_ip = 192.168.3.4` plus all new downstream fields were present.