Find or create a callback endpoint by URL

Finds or creates the callback endpoint at a URL in the caller's project and environment, without returning its signing secret. With no name, an existing endpoint that is not disabled at exactly this address is returned unchanged, preferring the one named after its URL; with a name, the endpoint must also carry that name. Otherwise one is created under the same rules as endpoints.create — HTTPS on effective port 443, no URL credentials or fragment, resolving only to public unicast addresses — and created is true. Optional headers apply only to an endpoint this call creates. Sent when the endpoint already exists, they are accepted if they are exactly its ordinary headers — what a retry of the creating call sends — and otherwise refused as state_conflict naming it; endpoints.update changes them. A secret value cannot be compared, so a call carrying one is refused for an endpoint that already exists. The result is metadata only: signingSecret says that the secret is not returned and where a signed-in member reveals it (revealUrl, the endpoint's dashboard page). Every callback is signed with that secret whether or not the receiver checks it. This is the endpoint operation agents use over MCP; endpoints.create, which returns the secret once, is withheld there.