feat(webhooks): reject SSRF-prone private hosts

[changliuchang777]

Summary

• add webhook URL validation with new URL() before storing destinations
• reject localhost, loopback, private IPv4 ranges, link-local metadata IPs, IPv6 loopback/link-local/ULA hosts, and IPv4-mapped private addresses
• reject non-default privileged ports below 1024 unless allowlisted through WEBHOOK_ALLOWED_LOW_PORTS
• keep the existing scheme/length checks and canonical 400 invalid_request response shape
• document the webhook SSRF policy and add focused webhook registration tests

Fixes #9

Validation

• git diff --check passed except Git for Windows LF/CRLF warnings
• npm test -- --runInBand src/__tests__/webhooks.test.ts blocked by existing baseline parse error in src/index.ts: duplicate WEBHOOK_MAX_EVENTS
• npm run build blocked by existing baseline TypeScript errors in src/index.ts and src/__tests__/store.adapter.test.ts
• npm run lint blocked by existing baseline lint errors unrelated to this change