feat(webhooks): add list and granular delete endpoints

- GET /:did/webhooks lists subscriptions for the authenticated owner
  (token field excluded — write-only as elsewhere).
- DELETE /:did/webhooks/:id deletes a single subscription. The query
  scopes on (did, id) so a verified caller cannot delete rows that
  belong to a different DID even with a valid id.

Also extracts the auth gate into requireDidOwnership now that three
endpoints share it.

src/data/db.ts

@@ -119,6 +119,23 @@ export const deleteWebhooksByDid = (did: string): void => {
   db.exec("DELETE FROM webhook_subscription WHERE did = ?", did);
 };
 
+export const deleteWebhookById = (
+  { did, id }: { did: string; id: number },
+): boolean => {
+  const result = db.prepare(
+    "DELETE FROM webhook_subscription WHERE did = ? AND id = ?",
+  ).run(did, id);
+  return result > 0;
+};
+
+export const listWebhooksByDid = (
+  did: string,
+): Omit<WebhookSubscriptionRow, "token">[] => {
+  return db.prepare(
+    "SELECT id, did, method, url, verb FROM webhook_subscription WHERE did = ? ORDER BY id DESC",
+  ).all<Omit<WebhookSubscriptionRow, "token">>(did);
+};
+
 export const getWebhooksByDidAndVerb = (
   did: string,
   verb: WebhookVerb,