Add a webhook destination (platform admins, browser session only)

A webhook destination. The URL is sealed with ENCRYPTION_KEY and never returned (a Slack incoming-webhook URL is itself a credential): urlDisplay shows scheme and host only. Format json is signed; the signing secret is shown once on creation and on rotation. Format slack is unsigned ({"text": ...}). 400 invalid_name, invalid_format. 409 name_taken (names are unique within the scope), too_many_destinations (at most 10 per team and 10 for the platform), team_archived. 422 url_not_allowed (details.reason: invalid, too_long, userinfo, fragment, scheme, private_address, blocked_address; the same address policy and internal-network allowlist as MCP servers, checked again on every delivery), invalid_events (details.events lists what this destination can't receive; at least one event is required). A platform destination receives publish.requested and key.expiring for platform tokens; with teamEvents true it also receives the other non-personal events of every team (422 invalid_events when events lists one of those and teamEvents is false).