HTTP API: register, list and remove webhooks, kept across restarts (closes #6)

POST, GET and DELETE under /api/v1/chats/{id}/webhooks, for the chats
that GET /api/v1/chats lists. The webhooks are kept in
$DATA_DIR/webhooks.json, mode 0600, which each change replaces whole
through a temporary file in the same directory and a rename. bot.Run
reads the file before it starts the chat client: absent means none, and
a file that cannot be read aborts startup. Reading a JSON request body
moved into decodeBody, which the messages endpoint now shares. Nothing
is posted to a webhook yet.

Model: opus-5-5

internal/api/api_test.go

@@ -23,6 +23,7 @@ const (
 
 	chatsPath    = "/api/v1/chats"
 	messagesPath = "/api/v1/chats/3/messages"
+	webhooksPath = "/api/v1/chats/3/webhooks"
 	unauthorized = `{"error":"unauthorized"}` + "\n"
 )
 
@@ -197,6 +198,12 @@ func TestNoPathIsExempt(t *testing.T) {
 			http.MethodPost, messagesPath, "",
 			http.StatusUnauthorized, unauthorized,
 		},
+		{http.MethodGet, webhooksPath, "", http.StatusUnauthorized, unauthorized},
+		{http.MethodPost, webhooksPath, "", http.StatusUnauthorized, unauthorized},
+		{
+			http.MethodDelete, webhooksPath + "/" + unknownID, "",
+			http.StatusUnauthorized, unauthorized,
+		},
 	} {
 		rec := request(t, srv, tc.method, tc.path, tc.auth)
 		if rec.Code != tc.want || rec.Body.String() != tc.body {