fix: restrict webhook endpoint to POST only (closes #20)

Add method check at the top of HandleWebhook, returning 405 Method Not
Allowed with an Allow: POST header for any non-POST request. This
prevents GET, PUT, DELETE, etc. from being accepted at entrypoint URLs.

internal/handlers/webhook.go

@@ -15,8 +15,15 @@ const (
 )
 
 // HandleWebhook handles incoming webhook requests at entrypoint URLs.
+// Only POST requests are accepted; all other methods return 405 Method Not Allowed.
 func (h *Handlers) HandleWebhook() http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodPost {
+			w.Header().Set("Allow", "POST")
+			http.Error(w, "Method Not Allowed", http.StatusMethodNotAllowed)
+			return
+		}
+
 		entrypointUUID := chi.URLParam(r, "uuid")
 		if entrypointUUID == "" {
 			http.NotFound(w, r)