feat: Initialize Zastava Webhook service with TLS and Authority authentication

- Added Program.cs to set up the web application with Serilog for logging, health check endpoints, and a placeholder admission endpoint.
- Configured Kestrel server to use TLS 1.3 and handle client certificates appropriately.
- Created StellaOps.Zastava.Webhook.csproj with necessary dependencies including Serilog and Polly.
- Documented tasks in TASKS.md for the Zastava Webhook project, outlining current work and exit criteria for each task.

deploy/compose/docker-compose.airgap.yaml

@@ -1,5 +1,3 @@
-version: "3.9"
-
 x-release-labels: &release-labels
   com.stellaops.release.version: "2025.09.2-airgap"
   com.stellaops.release.channel: "airgap"
@@ -164,6 +162,22 @@ services:
       - stellaops
     labels: *release-labels
 
+  notify-web:
+    image: ${NOTIFY_WEB_IMAGE:-registry.stella-ops.org/stellaops/notify-web:2025.09.2}
+    restart: unless-stopped
+    depends_on:
+      - mongo
+      - authority
+    environment:
+      DOTNET_ENVIRONMENT: Production
+    volumes:
+      - ../../etc/notify.prod.yaml:/app/etc/notify.yaml:ro
+    ports:
+      - "${NOTIFY_WEB_PORT:-9446}:8446"
+    networks:
+      - stellaops
+    labels: *release-labels
+
   excititor:
     image: registry.stella-ops.org/stellaops/excititor@sha256:65c0ee13f773efe920d7181512349a09d363ab3f3e177d276136bd2742325a68
     restart: unless-stopped