feat: add webhook management commands

[eslerm]

Add full webhook CRUD: create, list, get, update, delete, rotate-secret, and view delivery failures.

Scope

• 3 queries: webhook, webhooks, failuresForOauthWebhooks
• 4 mutations: webhookCreate, webhookUpdate, webhookDelete, webhookRotateSecret
• New command group with 7 subcommands
• Filter support: --team, --enabled
• Estimated ~1,330 LOC

Open Questions

• Should webhook get expose the secret? Or require --show-secret?
• Should webhook list show URLs? (potential security/PII concern in logs)
• Resource type validation: schema doesn't enumerate valid types as an enum

See planning/01-webhooks.md