HTTP API: register, list and remove webhooks, kept across restarts (closes #6)

An external app can register webhooks on a chat (`POST /api/v1/chats/{id}/webhooks` with a URL), list them, and remove one. Registering the same URL again returns the existing registration. Registrations are kept in `$DATA_DIR/webhooks.json`, rewritten whole on each change through a file created 0600, synced and renamed, so a crash leaves the old file or the new one; a file present but unreadable stops startup. Delivery of incoming messages is the next unit.

Disclosures: the JSON body reading is now one helper shared with the send endpoint; gosec G304 is suppressed on reading the webhooks file; the 0600-from-creation claim rests on `os.CreateTemp`'s source, not a system-call trace.

Model: opus-5-5

internal/bot/bot.go

@@ -54,12 +54,12 @@ const (
 
 var errExited = errors.New("simplex-chat exited")
 
-// Run starts the chat client with its database in cfg.DataDir, serving
-// its API on localhost at chatPort, connects to it, sets up the bot's
-// address, then answers messages and serves the bot's API until ctx is
-// cancelled — which is a clean stop and returns nil — or until the chat
-// client, the connection to it or the API's listener fails, which
-// returns the error.
+// Run reads the webhooks kept in cfg.DataDir, starts the chat client with
+// its database there, serving its API on localhost at chatPort, connects
+// to it, sets up the bot's address, then answers messages and serves the
+// bot's API until ctx is cancelled — which is a clean stop and returns
+// nil — or until the chat client, the connection to it or the API's
+// listener fails, which returns the error.
 func Run(
 	ctx context.Context, log *slog.Logger, cfg *config.Config, chatPort int,
 ) error {
@@ -68,6 +68,13 @@ func Run(
 		return fmt.Errorf("creating data directory: %w", err)
 	}
 
+	// Before the chat client starts, so that a file that cannot be read
+	// stops the bot as configuration that cannot be read does.
+	webhooks, err := api.ReadWebhooks(cfg.DataDir)
+	if err != nil {
+		return err
+	}
+
 	// Cancelling this stops the chat client; the deferred wait makes
 	// Run return only once it has exited, whatever path Run takes.
 	// Cancelling ctx does not reach it, so that the API, stopped first,
@@ -100,11 +107,12 @@ func Run(
 	}
 
 	srv := api.New(api.Params{
-		Log:    log,
-		Client: client,
-		UserID: user.UserID,
-		Port:   cfg.Port,
-		Token:  cfg.APIToken,
+		Log:      log,
+		Client:   client,
+		UserID:   user.UserID,
+		Port:     cfg.Port,
+		Token:    cfg.APIToken,
+		Webhooks: webhooks,
 	})
 
 	served := make(chan error, 1)