feat(api): add webhook subscription lifecycle management (closes #531)

[gbengaeben]

Summary

Adds the missing lifecycle management surface for webhook subscriptions (issue #531). Today a subscription can be created and its deliveries inspected, but never changed or stopped — the only escape hatch was a direct database update or a delete-plus-recreate (which loses delivery history and the signing secret). This PR closes that gap by reusing the schema's existing active flag, the repositories, and the retry schedule rather than inventing a parallel mechanism.

What changed

API (api/src/webhooks)

• GET /webhooks?streamId=&page=&limit= — paginated list of the caller's subscriptions, newest first, with an optional streamId filter. Owner-scoped by the user_id filter itself.
• PATCH /webhooks/:id — partial update of url, events, and/or active. The signing secret is deliberately not updatable: it is creation-time-only, returned exactly once by POST /webhooks. Deactivating stops new fan-out immediately (dispatchStreamEvent only matches active = true) and the retry sweep skips pending deliveries; reactivating resumes both. Pending deliveries of a deactivated subscription are left pending (not cancelled) so reactivation resumes their retry schedule unchanged — documented once in the controller JSDoc.
• DELETE /webhooks/:id — removes the subscription and, via the schema's ON DELETE CASCADE, its entire delivery history; returns 204.
• POST /webhooks/:id/deliveries/:deliveryId/retry — manually re-queues a failed/pending delivery (next_attempt_at → now). The attempt count is kept, so a manual retry still operates inside the existing MAX_RETRIES budget. 404 for unknown webhook/delivery or a mismatched pairing; 409 for an already-delivered delivery.
• Every route is ownership-guarded (subscription.userId check → 403) and Swagger-documented.

Repositories

• webhook-subscriptions-db.repository.ts / in-memory twin: added listByUser (with stream filter + pagination) and update (only fields present in changes, parameterised — no secret key exists on the path) and delete.
• webhook-deliveries-db.repository.ts / in-memory twin: added requeue.

Contracts & SDK

• tests/contracts: new webhooks.contract.ts covering create, list, update, retry, retry-404, and delete, plus the matching schemas (the creation response is the only one containing secret). Provider verification (api/src/contract-provider.spec.ts) and consumer verification (xstreamroll-sdk/__tests__/contract.consumer.test.ts) both exercise them.
• xstreamroll-sdk: new listWebhooks, updateWebhook, deleteWebhook, retryWebhookDelivery client methods, PATCH/DELETE support in HttpClient, WebhookSubscriptionSummary and UpdateWebhookDto types, and a README walkthrough of the full lifecycle (create → manage → deactivate/reactivate → redeliver → delete).
• GET /streams list now serializes ids to strings via toStreamResponse, matching the single-stream endpoints and the shared @xstreamroll/types#Stream string-id contract.

Testing

• Controller spec: ownership enforcement on every new route, empty-body rejection, secret stripping, 404/409 propagation.
• Service spec: list pagination/filtering, partial update semantics, deactivate stops fan-out, reactivate resumes fan-out and pending retries, retry re-queues a failed delivery inside the retry budget, sweep skips deactivated subscriptions.
• Provider and consumer contract suites pass for all new contracts.

Verification run locally:

cd api && npm run typecheck && npm test
cd ../xstreamroll-sdk && npm run typecheck && npm test

Out of scope (unchanged)

Secret rotation, delivery-signature format changes, and webhook URL SSRF protections remain separate issues, as noted in #531.

Closes #531

[Xhristin3]

LGTM