Update Slack Webhook

Add or remove a Slack webhook URL on an email subscription — with proof that the caller owns the address (W-FS-01). Proof is any of: the signed-in account (Bearer session / X-API-Key) whose email is the subscription; the subscriber's own token (token, the secret in their alert mails); or, for an anonymous caller, a confirmation link mailed to the address, which applies the change when clicked. Without proof nothing is written, so a stranger who knows an address cannot redirect that person's alerts to their own Slack.