List webhook configurations

Requires an owner/admin browser session with recent MFA. Tenant API keys and agent tokens cannot manage webhook configuration or delivery controls. Responses redact webhook secrets, payloads, webhook URLs in delivery rows, and raw provider error text except for the one-time secret returned by create.