Create webhook subscription

Creates a new outbound webhook subscription for the current tenant.

Safety and gating:

• The tenant must have the webhooks feature enabled in their plan.
• The requested event must be allowed for the tenant’s entitlements.
• The callback URL is validated to prevent SSRF and internal access.

Each subscription is assigned a per-tenant secret used to sign outbound webhook requests. platform is optional and is used to label the downstream integration target. If omitted, Catalyst treats the subscription as generic.