Let an entrypoint's description be edited in place (closes #392)

Each entrypoint on the webhook page has an Edit button that shows its
description as a form, with Save and Cancel, in place. Edit hides while
the form is open, and going back to the page does not put unsaved text
back into it, so the form always opens on the saved description.
Saving posts to /hook/{id}/entrypoints/{entrypointID}/edit, behind the
same login, CSRF and ownership checks as activate, deactivate and
delete, and writes only the description column, so the URL never
changes. An empty description shows as "Entrypoint". Activate and
deactivate now write only the active column, so they cannot write back
an older description over an edit.

Model: opus-5-5

README.md

@@ -1327,15 +1327,18 @@ under the real policy and checks that: both add forms stay hidden until Add is
 clicked; choosing Slack in the add target form leaves the HTTP fields out of
 what it submits, also after leaving the page and going back to it, when the
 browser restores the choice; the Copy button beside an entrypoint URL reads
-"Copied" once clicked; an event expands and collapses, and so do a delivery's
+"Copied" once clicked; an entrypoint's Edit button shows its edit form in place
+of its description and hides until the form closes, Cancel hides the form and
+drops what was typed, as does leaving the page and going back to it, and Save
+changes the description; an event expands and collapses, and so do a delivery's
 attempts inside it; and at phone width the menu button opens and closes the
-mobile menu. It also fails if the browser reports a console warning or error,
-an uncaught exception, or anything the policy refused. `make check` and the
-image build lint it but do not run it, and `make test` leaves it out (its file
-is built only with the `browser` build tag). Run it with `make test-browser`
-after changing `templates/` or `static/js/`: that builds `Dockerfile.browser`,
-which runs the test in a digest-pinned headless browser image, so the host
-needs no browser.
+mobile menu. It also fails if the browser reports a console warning or error, an
+uncaught exception, or anything the policy refused. `make check` and the image
+build lint it but do not run it, and `make test` leaves it out (its file is
+built only with the `browser` build tag). Run it with `make test-browser` after
+changing `templates/` or `static/js/`: that builds `Dockerfile.browser`, which
+runs the test in a digest-pinned headless browser image, so the host needs no
+browser.
 
 The package's tarball is committed as `3p/alpinejs-csp-3.14.9.tgz`, byte for
 byte as the npm registry publishes it. It is a dependency, not this repo's build
@@ -2917,6 +2920,7 @@ returns to the page that was asked for.
 | `POST` | `/hook/{id}/deliveries/{deliveryID}/replay` | Replay a finished delivery: creates a new delivery for the same event against the target's current configuration (30 per minute per bucket, then `429`) |
 | `POST` | `/hook/{id}/events/{eventID}/resubmit` | Resubmit a stored event: creates a new event copying it and fans that out to every currently active target (30 per minute per bucket, then `429`) |
 | `POST` | `/hook/{id}/entrypoints` | Add entrypoint to webhook |
+| `POST` | `/hook/{id}/entrypoints/{entrypointID}/edit` | Change an entrypoint's description; its URL stays the same |
 | `POST` | `/hook/{id}/entrypoints/{entrypointID}/delete` | Delete an entrypoint |
 | `POST` | `/hook/{id}/entrypoints/{entrypointID}/toggle` | Enable or disable an entrypoint |
 | `POST` | `/hook/{id}/targets`     | Add target to webhook |