feat: make webhooks and documents editable instead of delete-and-recreate

Both could only be created and deleted. For a webhook that is actively harmful:
recreating it issues a new signing secret, so the receiver that verifies the
X-ApiCore-Signature header against the old one starts rejecting every delivery
without anyone changing it on purpose.

Backend:
- New PATCH /webhooks/:id behind a new webhooks:update permission, covering the
  target URL, the event selection and the active flag - the last of which had
  no way to be set after creation at all, so a misbehaving receiver could only
  be deleted. The signing secret is deliberately left alone and stays out of
  the audit log.
- A changed webhook URL runs through the same assertPublicWebhookUrl SSRF check
  as a new one; without that the edit would have been a way around the guard
  create() applies. Covered by a test.
- New PATCH /documents/:id behind a new documents:update permission, for
  re-linking a document filed against the wrong record and correcting its
  display name. Re-linking validates the new target with the existing
  assertEntityExists; the stored file is untouched.

Frontend:
- New webhook edit dialog. The event labels and the toggle helper moved out of
  the create dialog into lib/webhooks/labels.ts so both use one copy.
- Documents can be renamed from the attachment card.

Re-linking a document to a different record has no UI yet: it needs a two-step
picker (colony, then inspection) that is not worth building unprompted.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

ApiCore-Frontend/src/lib/documents/api.ts

@@ -1,6 +1,10 @@
 import { apiFetch, apiFetchBlob, apiFetchFormData } from "@/lib/auth/api-client";
 import { downloadBlob } from "@/lib/export/api";
-import { DocumentEntityType, DocumentSummary } from "./types";
+import {
+  DocumentEntityType,
+  DocumentSummary,
+  UpdateDocumentInput,
+} from "./types";
 
 export function fetchDocuments(
   entityType: DocumentEntityType,
@@ -22,6 +26,16 @@ export function uploadDocument(
   return apiFetchFormData<DocumentSummary>("/documents", formData);
 }
 
+export function updateDocument(
+  id: string,
+  input: UpdateDocumentInput,
+): Promise<DocumentSummary> {
+  return apiFetch<DocumentSummary>(`/documents/${id}`, {
+    method: "PATCH",
+    body: JSON.stringify(input),
+  });
+}
+
 export function deleteDocument(id: string): Promise<void> {
   return apiFetch<void>(`/documents/${id}`, { method: "DELETE" });
 }

ApiCore-Frontend/src/lib/documents/types.ts

@@ -10,3 +10,9 @@ export interface DocumentSummary {
   uploadedByUserId: string | null;
   createdAt: string;
 }
+
+export interface UpdateDocumentInput {
+  entityType?: DocumentEntityType;
+  entityId?: string;
+  fileName?: string;
+}