fix: GitHub webhook route to API router

[ar4ntic]

• Integrated GitHub webhook routes into the API router.
• Updated test suite to verify the correct mount order for GitHub webhook handling.

---

Note

Low Risk
Routing-order change only; GitHub webhook behavior is unchanged aside from fixing incorrect auth rejection.

Overview
Fixes inbound GitHub deliveries to POST /api/webhooks/github/:integrationId being blocked by session auth on the outbound webhooks admin API before the GitHub handler could validate X-Hub-Signature-256.

createApiRouter now registers /webhooks/github with the core CE routes, before the authenticated /webhooks mount (which applies authMiddleware to all subpaths). The duplicate mount at the bottom of the router is removed.

The v1.2.2 changelog documents the fix. A route test asserts that with this order, requests hit the GitHub handler (401 Missing signature) instead of UNAUTHORIZED / Authentication required.

^{Reviewed by Cursor Bugbot for commit 73b8745. Bugbot is set up for automated code reviews on this repo. Configure here.}