docs: document webhook contracts

[udaya-ann]

Summary

• Document the generic webhook request payload and headers
• Document HMAC-SHA256 signature verification and a synthetic test vector
• Document retry behavior, duplicate delivery handling, event scopes, and replay protection
• Document Discord payload behavior, text truncation, and image URL handling
• Link the pending webhook lifecycle changes tracked by Stop pending webhook delivery after the endpoint is disabled #15 and Prevent deleted webhook endpoints from starving the delivery queue #16

Verification

• Reviewed the webhook implementation in internal/webhook/service.go and internal/webhook/model.go
• Confirmed the documented payload fields, headers, signature format, retry behavior, event scopes, and Discord handling against the current implementation

Closes #55

[LunaStev]

The webhook contract documentation otherwise matches the current implementation. There is one event-name mismatch to fix.

[LunaStev]

The current event constant in internal/webhook/model.go is mailing-list.message.created, not mailing-list.post. Please update this to the exact event type used by the implementation.

[LunaStev]

LGTM