Summary

Adds a full admin UI for the Webhooks & Event System, which was previously API-only.

Changes

• WebhookAdminController — Inertia controller with CRUD, secret rotation, delivery log, redeliver
• Settings/Webhooks.vue — dark-theme admin page matching existing Settings style
• 7 web routes under /admin/webhooks
• Sidebar nav entry (🔗 Webhooks, between API Tokens and Settings)
• WebhookAdminControllerTest — 33 test cases covering all endpoints + permission checks
• docs/features/webhooks-admin.md — feature guide

Security fixes (from audit)

• IDOR oracle eliminated: mutating endpoints now scope query to user's space_id before findOrFail
• Signing secret now returned on create (copy-once banner), matching rotate pattern
• Redeliver endpoint rate-limited to 10/min per user

Quality gates

• ✅ Pint
• ✅ PHPStan (level 5)
• ✅ 33 tests passing
• ✅ Security audit (no CRITICAL/HIGH)