Targets section: one Add, then a type and Next, then its fields (closes #370)

The webhook page's targets section lists only its targets until Add is
clicked. Add shows a choice of target type with Next; Next shows only
that type's fields, with Save and Cancel. The `database` and `log`
types have no URL field, and the `slack` form gains max retries.

A refused target now shows the webhook page again with the form open on
its type, the values entered and the reason, instead of a bare text
page. Target validation returns that message rather than writing the
response; newTarget validates a whole new target for reuse by the
new-webhook page. The edit page still answers a refusal in plain text.

Model: opus-5-5

README.md

@@ -1324,13 +1324,14 @@ markup. The CSP build runs no expressions, so every Alpine directive in
 `x-data="{ open: false }"` or `@click="open = !open"`.
 
 A browser test in `internal/server` loads the webhook page and the event log
-under the real policy and checks that: both add forms stay hidden until Add is
-clicked; choosing Slack in the add target form leaves the HTTP fields out of
-what it submits, also after leaving the page and going back to it, when the
-browser restores the choice; the Copy button beside an entrypoint URL reads
-"Copied" once clicked; an event expands and collapses, and so do a delivery's
-attempts inside it; and at phone width the menu button opens and closes the
-mobile menu. It also fails if the browser reports a console warning or error,
+under the real policy and checks that: the add entrypoint form stays hidden
+until Add is clicked; for every target type, the targets section's Add shows
+only a choice of type and Next, Next shows only that type's fields (no url field
+for `database` or `log`), Cancel closes the form, and saving adds the target;
+a refused target comes back with its form open, the values entered and the
+reason; the Copy button beside an entrypoint URL reads "Copied" once clicked; an
+event expands and collapses, and so do a delivery's attempts inside it; and at
+phone width the menu button opens and closes the mobile menu. It also fails if the browser reports a console warning or error,
 an uncaught exception, or anything the policy refused. `make check` and the
 image build lint it but do not run it, and `make test` leaves it out (its file
 is built only with the `browser` build tag). Run it with `make test-browser`