Ensure Gitlab Hook

Register the ONE GitLab group webhook pigeonly needs (docs/ 01_decisions/MARCS_ISSUES_GO_TO_MARCS_GITLAB.md, unit E4). Called from exactly this button on the System page's GitLab card, never from a request path -- gitlab_issues.create_group_hook has no upsert on GitLab's side, so calling it twice would register two hooks, and this route's own idempotency (below) is what stands in for one.

IDEMPOTENT ON THE STORED SECRET, not on asking GitLab. Once a webhook secret exists (gitlab_webhook.WEBHOOK_SECRET_CREDENTIAL_NAME), this returns already_configured without calling GitLab again -- the secret IS the evidence a hook was already created through this exact button, since nothing else in this codebase ever writes that credential name.

Returns stub (never calls GitLab) when no gitlab API credential is configured yet -- same "the build never stalls on a missing key" posture every other adapter in this codebase holds itself to.

The secret is returned in this response ONLY on the run that generates it -- there is nowhere to read a stored secret back out afterward (same as every other credential on this page), so a person who misses it here has to press the button again on a fresh secret... except this button will not press again once one is stored. If GitLab's own hook ever needs re-pointing, delete gitlab_webhook_secret first through DELETE /api/system/credentials/gitlab_webhook_secret, then press this again.