chore(scripts): add admin task to list every webhook

Direct SQLite read with no DID filter — complements the API-backed
`webhooks list`, which is scoped per DID.

deno.json

@@ -5,7 +5,8 @@
     "server": "deno run --watch --allow-net --allow-read --allow-write --allow-env --allow-ffi --unstable-ffi server.ts",
     "server:prod": "deno run --allow-net --allow-read --allow-write --allow-env --allow-ffi --unstable-ffi server.ts",
     "migrate": "deno run --allow-net --allow-read --allow-write --allow-env --allow-ffi --unstable-ffi src/migrations/init.ts",
-    "webhooks": "deno run --allow-net --allow-env scripts/manage-webhooks.ts"
+    "webhooks": "deno run --allow-net --allow-env scripts/manage-webhooks.ts",
+    "webhooks:all": "deno run --allow-read --allow-write --allow-env --allow-ffi --unstable-ffi scripts/list-all-webhooks.ts"
   },
   "imports": {
     "@db/sqlite": "jsr:@db/sqlite@^0.13.0",

scripts/list-all-webhooks.ts

@@ -0,0 +1,29 @@
+// Admin: list every webhook subscription from the local SQLite, across all
+// DIDs. Talks to the database directly — does NOT go through the API.
+//
+//   deno task webhooks:all
+//
+// Reads SQLITE_PATH (defaults to "notes.db"). The `token` column is
+// intentionally excluded from the output — it is a write-only secret.
+
+import { Database } from "@db/sqlite";
+
+type WebhookRow = {
+  id: number;
+  did: string;
+  method: string;
+  url: string;
+  verb: string;
+};
+
+const path = Deno.env.get("SQLITE_PATH") ?? "notes.db";
+const db = new Database(path);
+
+const rows = db.prepare(
+  "SELECT id, did, method, url, verb FROM webhook_subscription ORDER BY did, id",
+).all<WebhookRow>();
+
+console.log(JSON.stringify(rows, null, 2));
+console.error(`[done] ${rows.length} subscription(s) at ${path}`);
+
+db.close();