Add per-webhook secret generation and copyable callback URLs

[michaelmwu]

Summary

Add per-webhook secret management for external webhook integrations, starting with Docuseal (and extensible to future integrations), with admin dashboard support for generating, rotating, and copying callback URLs.

Context

Current webhook auth for /webhooks/* relies on the shared X-API-Secret. This couples all webhook sources to one secret and has limitations for operational security and management.

Proposal

• Generate a unique secret per webhook integration in the admin dashboard.
• Store webhook secrets securely and associate them with the integration configuration.
• Expose per-webhook callback URLs that include a webhook-specific secret (or secret reference) ready to copy.
• Use generated per-webhook secret during webhook authorization instead of/alongside global shared secret during migration.

Recommended first slice

1. Backend/API
   • Extend configuration model for webhook-specific secrets (starting with Docuseal).
   • Add API endpoints to view/regenerate webhook secrets.
   • Update Docuseal webhook auth in apps/worker/src/five08/backend/api.py to validate per-webhook secret for /webhooks/docuseal.
2. Admin dashboard UI
   • Add a webhook settings card for Docuseal with:
     • generated/visible masked secret (or copy-to-clipboard full secret)
     • generated endpoint URL with webhook secret inserted
     • regenerate button
3. Security/compliance
   • Redact secrets in logs and query logs (avoid exposing full secret in request logs).
   • Ensure secret rotation invalidates old secret cleanly.
   • Add validation/error states for disabled/misconfigured webhook secret.

Acceptance criteria

• Admin can generate/retrieve a Docuseal webhook secret from dashboard.
• Admin can copy a complete callback URL in one click.
• Invalid/missing Docuseal secret requests are rejected with 401.
• Existing Docuseal webhook success path remains asynchronous (202 for queued events).
• Add/adjust tests for webhook auth, invalid secret, and secret rotation.

Notes

• Keep current X-API-Secret header path as temporary compatibility during migration, and plan a phased rollout away from global secret dependence.