Declare a Webhook on an app

Session-gated; requires app:write. Declares one of the app’s ops as a Webhook target an external sender can invoke by POSTing to the returned url with the returned secret (shown once). Unlike a Routine, the op may declare required input: the sender supplies the body. Rejects a duplicate (app, op) pair and enforces a per-app and a per-owner cap from the app owner's plan, which for a team app is the team's plan rather than the caller's. limits on GET /api/v1/webhooks reports the caller's own plan, so it matches only their personal apps. The free defaults are 3 per app and 25 per owner.