Keep each model's parent out of its JSON (closes #177)

Every reference from a model to the record it belongs to is now
json:"-", so the webhook and target models (and the other parent and
child pairs in internal/database) can no longer marshal each other in
a loop. GORM ignores json tags, so preloading still fills these
references; a new test preloads a webhook with its targets and
entrypoints and a target with its webhook, checks the references are
filled, and checks the marshalled JSON leaves them out.

Model: opus-5-5

internal/database/model_apikey.go

@@ -15,6 +15,7 @@ type APIKey struct {
 	Description string     `json:"description"`
 	LastUsedAt  *time.Time `json:"lastUsedAt,omitempty"`
 
-	// Relations
-	User User `json:"user,omitzero"`
+	// Relations. No model marshals the record it belongs to:
+	// User.APIKeys leads back here, and the JSON could loop.
+	User User `json:"-"`
 }