feat: add optional bearer token support for webhook subscriptions

Token is stored in the DB but never returned in API responses (write-only).
fireWebhooks() sends Authorization: Bearer <token> header when present.

jetstream.ts

@@ -24,10 +24,13 @@ const fireWebhooks = async (
   const webhooks = getWebhooksByDid(did);
   if (webhooks.length === 0) return;
   const results = await Promise.allSettled(
-    webhooks.map(({ method, url }) =>
+    webhooks.map(({ method, url, token }) =>
       fetch(url, {
         method,
-        headers: { "Content-Type": "application/json" },
+        headers: {
+          "Content-Type": "application/json",
+          ...(token ? { Authorization: `Bearer ${token}` } : {}),
+        },
         body: JSON.stringify(payload),
       })
     ),