feat(webhooks): add admin endpoint to list every subscription

Adds GET /admin/webhooks gated by an ADMIN_DIDS env-var allowlist of
verified AT Proto DIDs. Fail-closed: if ADMIN_DIDS is unset, the route
always returns 403 — no accidental exposure on deploys that forget it.

src/data/db.ts

@@ -136,6 +136,12 @@ export const listWebhooksByDid = (
   ).all<Omit<WebhookSubscriptionRow, "token">>(did);
 };
 
+export const listAllWebhooks = (): Omit<WebhookSubscriptionRow, "token">[] => {
+  return db.prepare(
+    "SELECT id, did, method, url, verb FROM webhook_subscription ORDER BY did, id",
+  ).all<Omit<WebhookSubscriptionRow, "token">>();
+};
+
 export const getWebhooksByDidAndVerb = (
   did: string,
   verb: WebhookVerb,