Switch Evotor integration to webhook-based token delivery flow

Replace OAuth 2.0 authorization code flow with Evotor's proprietary
webhook token delivery: POST /evotor/callback receives token server-to-server,
GET /evotor/link links it to the logged-in user's account.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

web/migrations/versions/f6a7b8c9d0e1_evotor_webhook_token_flow.py

@@ -0,0 +1,32 @@
+"""evotor webhook token flow: add evotor_user_id, make user_id nullable
+
+Revision ID: f6a7b8c9d0e1
+Revises: e5f6a7b8c9d0
+Branch Labels: None
+Depends On: None
+
+"""
+from alembic import op
+import sqlalchemy as sa
+
+revision = 'f6a7b8c9d0e1'
+down_revision = 'e5f6a7b8c9d0'
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.add_column('evotor_connections',
+        sa.Column('evotor_user_id', sa.String(255), nullable=True))
+    op.create_unique_constraint('uq_evotor_connections_evotor_user_id',
+        'evotor_connections', ['evotor_user_id'])
+    op.create_index('ix_evotor_connections_evotor_user_id',
+        'evotor_connections', ['evotor_user_id'])
+    op.alter_column('evotor_connections', 'user_id', nullable=True)
+
+
+def downgrade() -> None:
+    op.alter_column('evotor_connections', 'user_id', nullable=False)
+    op.drop_index('ix_evotor_connections_evotor_user_id', 'evotor_connections')
+    op.drop_constraint('uq_evotor_connections_evotor_user_id', 'evotor_connections')
+    op.drop_column('evotor_connections', 'evotor_user_id')