feat(web): webhook subscriptions CRUD UI + global nav expansion

[Roddygithub]

Summary

• New CreateWebhookPanel Client Component: 3-phase state machine (closed -> form -> reveal) where the form opens on click, URL/description/filter JSON submit via POST /api/v1/webhooks, and the reveal phase shows the ONE-SHOT plaintext secret with copy-to-clipboard + a mandatory I have securely stored this secret acknowledgement checkbox before Done (which calls router.refresh() so the new row appears in the grid).
• New WebhookSubscriptionsGrid Client Component (AG Grid): id / url / description / filter (key-sorted summary) / created_at columns + a per-row Revoke button. Calls DELETE /api/v1/webhooks/{id} then router.refresh().
• Extended GET /api/v1/webhooks client (fetchWebhookSubscriptions) + createWebhook + revokeWebhook export (api/webhooks.ts).
• Rewrote web/src/app/webhooks/page.tsx as a force-dynamic Server Component that Promise.allSettled-fetches subscriptions + DLQ in parallel with per-section error isolation (one section failing does NOT block the other).
• Added /players + /players/compare + /webhooks + /account + /upload to the global header nav (layout.tsx). The pre-PR2 nav surfaced only Players + Compare.
• Extracted shared formatDateTime util in web/src/lib/format.ts (DRY across WebhookDlqGrid + WebhookSubscriptionsGrid).

Commits

1. feat(web): extract shared formatDateTime in lib/format + refactor DLQ grid
2. feat(web): add WebhookSubscriptionRow/Out types + fetch/create/revoke API
3. feat(web): CreateWebhookPanel -- 3-phase state machine + one-shot secret reveal
4. feat(web): WebhookSubscriptionsGrid -- AG Grid table + revoke action
5. feat(web): extend /webhooks to render subs + DLQ; expose 5 pages in header nav
6. test(web): 13 webhook-UI tests (page + CreateWebhookPanel + SubscriptionsGrid)

Why the inline create modal (not a separate route)

The backend returns the plaintext secret ONCE on the 201 response (Fernet envelope encryption-at-rest for every later fetch). A multi-page wizard would require server-side storage of the in-flight secret to survive a refresh, which we explicitly avoid. The single Client Component keeps the plaintext secret in React state for the lifetime of the wizard and only crosses the network once.

Test plan

• cd web && pnpm typecheck — passes (TypeScript valid).
• cd web && pnpm exec vitest run tests/app/webhooks-page.test.tsx tests/components/CreateWebhookPanel.test.tsx tests/components/WebhookSubscriptionsGrid.test.tsx — 13/13 pass.
• The 13 tests cover: happy-path subscriptions render, parallel-fetch error isolation (each section surfaces its own error), CreateWebhookPanel state-machine transitions (closed -> form -> reveal + ack-enables-Done), WebhookSubscriptionsGrid empty state + revoke happy + revoke failure.
• Manual: /webhooks renders the 2 section cards; clicking + New subscription opens the form, mock-typing + submitting transitions to the reveal callout with the one-shot secret visible.

Out of scope (deferred)

• subscribed_event_types filter UX is JSON-as-text only; a structured key=value UI is a v0.12 follow-up.
• Bulk subscribe / multi-secret reveal (single one-shot secret at a time only).
• Per-event-type PNG / favicon via the secret hex (the whsec_ prefix is the canonical GW2 community compatibility marker).