Add endpoint management and delivery operations

[quangshuynh]

Summary

Adds the first authenticated management API for operating Hymical Forms.

Included

• paginated endpoint listing and detail
• endpoint updates and enable/disable
• webhook destination changes with signing-secret rotation
• paginated delivery inspection and filtering
• delivery attempt history
• manual replay of terminal failed deliveries
• fresh retry cycles while preserving lifetime attempt history
• migration 0003
• PostgreSQL concurrent replay coverage

Replay semantics

Manual replay:

• operates on the existing logical delivery
• preserves all historical attempts
• resets only the current retry-cycle budget
• does not create another submission or delivery
• performs no network request in the API process
• leaves delivery to the existing worker

Security

All new routes require the existing management API key authentication.

Webhook signing secrets and management credentials are never exposed through read APIs.

Current limitations

• no endpoint deletion
• no submission browsing
• no in-place signing-secret rotation
• no users, roles, or tenant ownership
• partial SSRF protection remains
• rate limiting and spam protection are not implemented