Fix Jira webhook secret rotation and unsolicited project comments

[ayushtr-aws]

Problem

Customer deployments using Jira admin-console webhooks encounter three related failures:

• Generic Jira webhook payloads omit cloudId, so verification uses the stack-wide fallback secret. Re-running bgagent jira setup updates the tenant bundle but leaves an already-configured fallback unchanged, causing 401 signature failures after rotation.
• The webhook processor posts failure comments for projects that are not mapped to ABCA before checking trigger admission, creating comments from ordinary Jira create/update activity.
• A linked account can still appear unlinked when the webhook actor differs from the account that was linked; current diagnostics do not make the selected actor identity/source clear.

Acceptance criteria

• A sole active Jira tenant can rotate its webhook secret without repeating OAuth; tenant and stack-wide secrets remain synchronized.
• Multi-tenant admin-console webhook configuration fails clearly because payloads without cloudId cannot select a per-tenant secret.
• Events from unmapped Jira projects never post ABCA comments.
• Mapped projects only receive failure feedback after the configured trigger is explicitly asserted.
• User-link diagnostics identify which Jira account and payload field were used for attribution.
• Setup/troubleshooting documentation and focused tests cover rotation and admission behavior.

[ayushtr-aws]

Starting implementation. I reproduced the stale stack-wide secret path and the pre-admission feedback behavior on the customer branch; implementing on a main-based fix branch, then backporting to linear-vercel.

[ayushtr-aws]

Implementation target updated per maintainer direction: applying and testing directly on linear-vercel, then opening the PR to main.