List endpoints

Every endpoint registered for the project, with the event patterns each subscribes to and whether it is enabled.

This response includes each endpoint's whsec_… signing secret, not just the create call. That makes rotation-free recovery easy — you can always read the secret back — but it also makes this response a credential, so treat it like one and never proxy it to a browser.