feat(webhooks): validate and bound request inputs

[Marvelg256]

• Add rejectInvalidWebhookId helper validating webhook id format (wh_ + 16 lowercase hex chars) on GET/:id, DELETE/:id, PATCH/:id
• Fix PATCH handler: remove duplicate rejectUnknownKeys call and reuse validateWebhookEvents instead of duplicating inline event validation
• Add WEBHOOK_MAX_URL_LENGTH constant for URL length bound
• Add 18 parameterized tests covering malformed webhook IDs on GET, DELETE, and PATCH
• Update existing 404 test cases to use valid-format but non-existent IDs (wh_0000000000000000)
• Document webhook ID route param validation in docs/validation.md

Closes #406

Summary

Related Issue

Closes #

Validation

• npm run build
• npm run lint
• npm test

Checklist

• I kept the change focused on the linked issue.
• I added or updated tests for behavior changes.
• I updated documentation when commands, API behavior, or setup changed.
• I did not commit secrets, tokens, .env files, or private credentials.

Security Notes

Describe any security assumptions, risks, or mitigations. Write N/A for docs-only changes.