fix: restrict webhook endpoint to POST only (closes #20)

Add method check at the top of HandleWebhook, returning 405 Method Not
Allowed with an Allow: POST header for any non-POST request. This
prevents GET, PUT, DELETE, etc. from being accepted at entrypoint URLs.

internal/server/routes.go

@@ -109,6 +109,8 @@ func (s *Server) SetupRoutes() {
 		r.Post("/targets", s.h.HandleTargetCreate())         // Add target
 	})
 
-	// Entrypoint endpoint - accepts incoming webhook POST requests
+	// Entrypoint endpoint — accepts incoming webhook POST requests only.
+	// Using HandleFunc so the handler itself can return 405 for non-POST
+	// methods (chi's Method routing returns 405 without Allow header).
 	s.router.HandleFunc("/webhook/{uuid}", s.h.HandleWebhook())
 }