feat: make webhooks and documents editable instead of delete-and-recreate

Both could only be created and deleted. For a webhook that is actively harmful:
recreating it issues a new signing secret, so the receiver that verifies the
X-ApiCore-Signature header against the old one starts rejecting every delivery
without anyone changing it on purpose.

Backend:
- New PATCH /webhooks/:id behind a new webhooks:update permission, covering the
  target URL, the event selection and the active flag - the last of which had
  no way to be set after creation at all, so a misbehaving receiver could only
  be deleted. The signing secret is deliberately left alone and stays out of
  the audit log.
- A changed webhook URL runs through the same assertPublicWebhookUrl SSRF check
  as a new one; without that the edit would have been a way around the guard
  create() applies. Covered by a test.
- New PATCH /documents/:id behind a new documents:update permission, for
  re-linking a document filed against the wrong record and correcting its
  display name. Re-linking validates the new target with the existing
  assertEntityExists; the stored file is untouched.

Frontend:
- New webhook edit dialog. The event labels and the toggle helper moved out of
  the create dialog into lib/webhooks/labels.ts so both use one copy.
- Documents can be renamed from the attachment card.

Re-linking a document to a different record has no UI yet: it needs a two-step
picker (colony, then inspection) that is not worth building unprompted.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

ApiCore-Frontend/src/lib/documents/api.ts

@@ -1,6 +1,10 @@
 import { apiFetch, apiFetchBlob, apiFetchFormData } from "@/lib/auth/api-client";
 import { downloadBlob } from "@/lib/export/api";
-import { DocumentEntityType, DocumentSummary } from "./types";
+import {
+  DocumentEntityType,
+  DocumentSummary,
+  UpdateDocumentInput,
+} from "./types";
 
 export function fetchDocuments(
   entityType: DocumentEntityType,
@@ -22,6 +26,16 @@ export function uploadDocument(
   return apiFetchFormData<DocumentSummary>("/documents", formData);
 }
 
+export function updateDocument(
+  id: string,
+  input: UpdateDocumentInput,
+): Promise<DocumentSummary> {
+  return apiFetch<DocumentSummary>(`/documents/${id}`, {
+    method: "PATCH",
+    body: JSON.stringify(input),
+  });
+}
+
 export function deleteDocument(id: string): Promise<void> {
   return apiFetch<void>(`/documents/${id}`, { method: "DELETE" });
 }

ApiCore-Frontend/src/lib/documents/types.ts

@@ -10,3 +10,9 @@ export interface DocumentSummary {
   uploadedByUserId: string | null;
   createdAt: string;
 }
+
+export interface UpdateDocumentInput {
+  entityType?: DocumentEntityType;
+  entityId?: string;
+  fileName?: string;
+}

ApiCore-Frontend/src/lib/webhooks/api.ts

@@ -1,5 +1,10 @@
 import { apiFetch } from "@/lib/auth/api-client";
-import { CreateWebhookInput, WebhookSubscription, WebhookSubscriptionWithSecret } from "./types";
+import {
+  CreateWebhookInput,
+  UpdateWebhookInput,
+  WebhookSubscription,
+  WebhookSubscriptionWithSecret,
+} from "./types";
 
 export function fetchWebhooks(): Promise<WebhookSubscription[]> {
   return apiFetch<WebhookSubscription[]>("/webhooks");
@@ -12,6 +17,16 @@ export function createWebhook(input: CreateWebhookInput): Promise<WebhookSubscri
   });
 }
 
+export function updateWebhook(
+  id: string,
+  input: UpdateWebhookInput,
+): Promise<WebhookSubscription> {
+  return apiFetch<WebhookSubscription>(`/webhooks/${id}`, {
+    method: "PATCH",
+    body: JSON.stringify(input),
+  });
+}
+
 export function deleteWebhook(id: string): Promise<void> {
   return apiFetch<void>(`/webhooks/${id}`, { method: "DELETE" });
 }

ApiCore-Frontend/src/lib/webhooks/labels.ts

@@ -0,0 +1,24 @@
+import { WebhookEvent } from "./types";
+
+export const WEBHOOK_EVENT_LABELS: Record<WebhookEvent, string> = {
+  "colony.created": "Volk angelegt",
+  "inspection.created": "Durchsicht erfasst",
+  "queen.created": "Königin angelegt",
+  "queen.replaced": "Königin zugewiesen/ersetzt",
+  "harvest.created": "Ernte erfasst",
+  "batch.created": "Honigcharge angelegt",
+  "batch.updated": "Honigcharge geändert",
+  "product.stock_changed": "Lagerbestand geändert",
+  "task.created": "Aufgabe angelegt",
+  "task.completed": "Aufgabe erledigt",
+};
+
+export function toggleWebhookEvent(
+  events: WebhookEvent[],
+  event: WebhookEvent,
+  checked: boolean,
+): WebhookEvent[] {
+  return checked
+    ? [...events, event]
+    : events.filter((entry) => entry !== event);
+}

ApiCore-Frontend/src/lib/webhooks/types.ts

@@ -31,3 +31,9 @@ export interface CreateWebhookInput {
   url: string;
   events: WebhookEvent[];
 }
+
+export interface UpdateWebhookInput {
+  url?: string;
+  events?: WebhookEvent[];
+  active?: boolean;
+}