HTTP API: register, list and remove webhooks, kept across restarts (closes #6)

POST, GET and DELETE under /api/v1/chats/{id}/webhooks, for the chats
that GET /api/v1/chats lists. The webhooks are kept in
$DATA_DIR/webhooks.json, mode 0600, which each change replaces whole
through a temporary file in the same directory and a rename. bot.Run
reads the file before it starts the chat client: absent means none, and
a file that cannot be read aborts startup. Reading a JSON request body
moved into decodeBody, which the messages endpoint now shares. Nothing
is posted to a webhook yet.

Model: opus-5-5

docs/TODO.md

@@ -27,6 +27,8 @@ with no deprecation warning.
 
 # Completed Steps
 
+- 2026-09-29 `POST`, `GET` and `DELETE` on a chat's webhooks, under
+  `/api/v1/chats/{id}/webhooks`, kept in `$DATA_DIR/webhooks.json`
 - 2026-09-29 `GET` and `POST /api/v1/chats/{id}/messages`: a chat's
   latest messages, and sending one
 - 2026-09-29 Added the HTTP API in `internal/api`: the server on `PORT`,