feat: add optional bearer token support for webhook subscriptions

Token is stored in the DB but never returned in API responses (write-only).
fireWebhooks() sends Authorization: Bearer <token> header when present.

src/migrations/init.ts

@@ -55,4 +55,10 @@ db.exec(`
     ON webhook_subscription(did);
 `);
 
+try {
+  db.exec(`ALTER TABLE webhook_subscription ADD COLUMN token TEXT;`);
+} catch {
+  // Column already exists — no-op
+}
+
 db.close();