feat(api): Add a GET /v1/wallets/:id/webhooks route to list registered endpoints (currently write-only)

[Emmyt24]

Description

crates/api/src/routes/webhooks.rs only exposes POST (create) — there is no way to list a wallet's already-registered webhook endpoints via the API at all, even though Store::active_webhook_endpoints already exists and is used internally by WebhookSender::dispatch. An integrator who registered a webhook weeks ago and forgot the exact URL (or wants to confirm how many endpoints they've registered) currently has no way to check via the API.

Requirements and Context

• Add GET /v1/wallets/:id/webhooks, authorized via authorize_wallet (same as create), returning each endpoint's id, url, active status, and created_at — never the secret (unlike the creation response, which does return it once; this is a read of already-registered endpoints, and re-exposing the secret on every list call would defeat the point of only returning it once).

Suggested Execution

Branch: feat/api/list-webhook-endpoints-route

Implement Changes

• Add a WebhookListView struct (mirroring WebhookView but omitting secret) and a list_webhooks handler to crates/api/src/routes/webhooks.rs, reusing Store::active_webhook_endpoints (or add an unfiltered variant if inactive/deactivated endpoints should also be listed — decide and justify in the PR description).
• Register the route in crates/api/src/lib.rs::build_router.

Test and Commit

• list_webhooks_returns_registered_endpoints_without_the_secret.
• list_webhooks_on_unowned_wallet_is_404.
• list_webhooks_on_a_wallet_with_no_endpoints_returns_an_empty_list.
• Run cargo test -p octo-api locally before committing.

Example Commit Message

feat(api): add GET /v1/wallets/:id/webhooks to list registered endpoints

Webhook endpoints could be created but never listed back through the API.
Adds a read-only listing route that deliberately omits the signing secret
(which is only ever returned once, at creation time) to avoid re-exposing it
on every subsequent read.

Guidelines

• Double-check the response struct genuinely omits secret — copy-pasting WebhookView without removing the field would silently reintroduce a secret-leak on every list call.
• Reference this issue with Closes #<issue-number> in the PR description.

[devfoma]

Hellp, I would love to take on this issue. I'm a software engineer with over 4 years experience. and i'm confident I can resolve this issue

[grantfox-oss]

🦊 GrantFox — @devfoma has been assigned to this issue as part of the Official Campaign | FWC26 campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #115)
2. Your PR will be reviewed by the Octo-Protocol-org maintainers

Good luck! Track your progress on GrantFox.