Register a webhook endpoint

Returns the signing secret exactly once. Every delivery is signed with HMAC-SHA256 over the timestamp, a period, and the raw request body; verify it and reject stale timestamps. The URL is validated at registration and the connection pinned at delivery, so an endpoint pointing at a private address is refused. Works with an API key holding webhooks:write, so a deploy script can register its own endpoint; every change is audited.