Soft-disable a webhook endpoint

Soft disable, not a delete: sets is_active: false, disabled_reason: "user" and disabled_at. The endpoint stays in GET /webhooks with its delivery history (readable via the deliveries route). Nothing more is sent to it, including deliveries already queued. There is no hard delete and no re-enable or update operation; create a new endpoint instead. A disabled endpoint does not count toward the quota.