HTTP API: register, list and remove webhooks, kept across restarts (closes #6)

An external app can register webhooks on a chat (`POST /api/v1/chats/{id}/webhooks` with a URL), list them, and remove one. Registering the same URL again returns the existing registration. Registrations are kept in `$DATA_DIR/webhooks.json`, rewritten whole on each change through a file created 0600, synced and renamed, so a crash leaves the old file or the new one; a file present but unreadable stops startup. Delivery of incoming messages is the next unit.

Disclosures: the JSON body reading is now one helper shared with the send endpoint; gosec G304 is suppressed on reading the webhooks file; the 0600-from-creation claim rests on `os.CreateTemp`'s source, not a system-call trace.

Model: opus-5-5

Dockerfile

@@ -109,9 +109,9 @@ WORKDIR /app
 COPY --from=builder /build/bin/simplexcalc /app/simplexcalc
 
 # Data directory: the SimpleX database, which holds the bot's profile,
-# its keys, its address and its contacts. Mount a volume over it;
-# without one, the bot gets a new address every time the container is
-# recreated.
+# its keys, its address and its contacts, and the API's webhooks. Mount
+# a volume over it; without one, the bot gets a new address and loses
+# its webhooks every time the container is recreated.
 RUN mkdir -p /var/lib/simplexcalc && \
     chown simplexcalc:simplexcalc /var/lib/simplexcalc