Register an outbound webhook endpoint (paid tiers)

Register a webhook for pair.created / spread.threshold. Free is 403'd (paid-tier gate); an org may hold at most webhook_admin.MAX_ENDPOINTS_PER_ORG (3) endpoints (409 past that). The signing secret is returned ONCE, here, in the 201 body — same reveal-once contract as POST /v1/keys (only its HMAC-equivalent, the plaintext itself, is stored — see keys.generate_webhook_secret's docstring for why plaintext is correct here, unlike an sk_live_ key). sync def (threadpooled IO).