Repoint a webhook endpoint

Points an existing endpoint at a new URL. PATCH rather than PUT because url is the only mutable field, so the body is a partial by construction. The signing secret is deliberately UNTOUCHED — moving hosts must not force a receiver to re-key; rotating is the explicit sibling call. Same URL policy and same duplicate rule as create; the plan cap is NOT re-checked, because an update never grows the set and an app already over a lowered cap must still be able to fix a wrong URL. A URL that actually CHANGES also resumes an auto-paused endpoint (pausedAt back to null) and restarts its 7-day clock — a new address is the usual fix for a dead one. An unknown id and another app's id both answer 404.