Register a webhook for story events

Registers an https URL to receive story.new and story.updated events as the pipeline publishes them (runs every 30 minutes). Registration performs a challenge handshake so this API cannot be used to send traffic to third parties: TechSnif POSTs { "type": "webhook.verify", "challenge": "<uuid>" } to the url, and the endpoint must respond with a 2xx status and include the challenge string anywhere in its response body within 10 seconds, otherwise registration fails with 422. The 201 response includes the signing secret exactly once. Deliveries are POSTs of { "events": [...] } where each event has type, id, at, and story (a StorySummary object); the id field is stable and usable for deduplication. Every delivery carries an X-TechSnif-Signature header of the form sha256=<hex HMAC-SHA256 of the raw request body, computed with the secret>. Verify a delivery by recomputing the HMAC over the exact raw body bytes and comparing hex digests. Subscriptions are disabled after 10 consecutive delivery failures. Only https URLs on the default port are accepted (no localhost, no raw IP hosts), topics is limited to 20 slugs, and per-host and global registration caps apply.