Document the webhook management API

[qayshp]

Summary

• add a dedicated guide for listing, creating, and deleting webhooks through the REST API
• include authenticated curl examples and successful response shapes
• document wildcard subscriptions, unique-URL behavior, and common API errors
• keep the examples compatible with older macOS curl versions
• add the guide to the server documentation table of contents

Validation

• git diff --check origin/master...HEAD passes
• all three JSON response examples parse successfully
• every documented route, field, response, and behavior matches the current server router, validator, entity, and repository code
• the referenced internal documentation links resolve
• list, single-ID GET, JSON POST, and DELETE requests were exercised against a local receiver with a password containing a space and &; their methods, encoded queries, and POST body were preserved

Notes

• This documents API endpoints that already exist in the server; it does not change server behavior.
• PR Document webhook payloads and event keys #32 separately expands the full webhook event-key and payload reference.
• No authenticated live-server round trip was required for the local command-compatibility check.

Fixes BlueBubblesApp/bluebubbles-server#519

[qayshp]

Self-review focused on keeping the automation examples usable across supported macOS environments.

[qayshp]

Validation update

• Commit 39197da removed the extra blank line that caused the earlier diff-check failure.
• git diff --check origin/master...HEAD now passes.
• All three JSON response examples parse successfully.
• The documented GET, POST, and DELETE routes, response shapes, unique-URL behavior, and error cases match the current router, validator, entity, and repository code.
• The curl 8.7.1 installed on this Mac supports --url-query.

No authenticated live-server API round trip was performed in this pass. The current-machine curl check also does not establish compatibility with the much older curl versions bundled with the oldest supported macOS releases.

[qayshp]

Validation supersession: the earlier old-curl limitation was addressed in 6ffc4e1. The examples no longer use --url-query; list, single-ID GET, JSON POST, and DELETE were exercised locally with reserved password characters while preserving methods, encoded queries, and the POST body. Current source comparison plus JSON, link, shell-syntax, and diff checks pass.