Create a webhook

Returns the signing secret exactly once. Store it immediately; it cannot be re-derived. Subscribe with canonical `subscriptions[]` entries containing `eventType`, `version`, and optional filters. All deliveries use one CloudEvents 1.0 structured envelope. Internal topics and provider-native payloads are never public.