feat: make webhooks and documents editable instead of delete-and-recreate

Both could only be created and deleted. For a webhook that is actively harmful:
recreating it issues a new signing secret, so the receiver that verifies the
X-ApiCore-Signature header against the old one starts rejecting every delivery
without anyone changing it on purpose.

Backend:
- New PATCH /webhooks/:id behind a new webhooks:update permission, covering the
  target URL, the event selection and the active flag - the last of which had
  no way to be set after creation at all, so a misbehaving receiver could only
  be deleted. The signing secret is deliberately left alone and stays out of
  the audit log.
- A changed webhook URL runs through the same assertPublicWebhookUrl SSRF check
  as a new one; without that the edit would have been a way around the guard
  create() applies. Covered by a test.
- New PATCH /documents/:id behind a new documents:update permission, for
  re-linking a document filed against the wrong record and correcting its
  display name. Re-linking validates the new target with the existing
  assertEntityExists; the stored file is untouched.

Frontend:
- New webhook edit dialog. The event labels and the toggle helper moved out of
  the create dialog into lib/webhooks/labels.ts so both use one copy.
- Documents can be renamed from the attachment card.

Re-linking a document to a different record has no UI yet: it needs a two-step
picker (colony, then inspection) that is not worth building unprompted.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

ApiCore-Backend/src/documents/documents.service.ts

@@ -11,6 +11,7 @@ import { AuditLogService } from '../audit/audit-log.service';
 import { matchesFileSignature } from '../common/file-signature';
 import { Document, DocumentEntityType } from '../../generated/prisma';
 import { ALLOWED_DOCUMENT_MIME_TYPES } from './document-mime-types';
+import { UpdateDocumentDto } from './dto/update-document.dto';
 
 export type DocumentSummary = Omit<Document, 'storagePath'>;
 
@@ -139,6 +140,40 @@ export class DocumentsService {
     };
   }
 
+  /**
+   * Re-links a document to a different record or corrects its display name.
+   * The stored file is untouched - replacing the content means uploading a
+   * new document.
+   */
+  async update(
+    id: string,
+    dto: UpdateDocumentDto,
+    actingUserId: string,
+  ): Promise<DocumentSummary> {
+    const before = await this.prisma.document.findUnique({ where: { id } });
+    if (!before) {
+      throw new NotFoundException('Document not found');
+    }
+    const entityType = dto.entityType ?? before.entityType;
+    const entityId = dto.entityId ?? before.entityId;
+    if (entityType !== before.entityType || entityId !== before.entityId) {
+      await this.assertEntityExists(entityType, entityId);
+    }
+    const document = await this.prisma.document.update({
+      where: { id },
+      data: { entityType, entityId, fileName: dto.fileName },
+    });
+    await this.auditLog.record({
+      entityType: 'Document',
+      entityId: id,
+      action: 'UPDATE',
+      userId: actingUserId,
+      beforeData: toSummary(before),
+      afterData: toSummary(document),
+    });
+    return toSummary(document);
+  }
+
   async delete(id: string, actingUserId: string): Promise<void> {
     const document = await this.prisma.document.findUnique({
       where: { id },