Turns the consumer's resource into the outbound Subscription — which events go to which endpoint, and with which signature envelope.

use Ash.Resource,
  data_layer: AshSqlite.DataLayer,
  extensions: [AshHooks.Subscription]

subscription do
  endpoint_resource(MyApp.WebhookEndpoint)
end

The extension injects: event_types ({:array, :string}, default ["*"]), endpoint_id (uuid — the pk of the endpoint_resource), and signing_mode (:legacy | :dual | :standard, NULLABLE — the outbound declaration's mode applies when unset: ADR-0002's per-subscription mode).

Matching is exact strings plus the bare "*" entry, evaluated IN MEMORY by the dispatcher after reading through the consumer's primary read action — no array-containment SQL, so the semantics are identical on every data layer.

The package injects NO read action: read surfaces are the consumer's to open (the default-deny floor, ADR-0005) — the dispatcher's internal reads run unauthorized, the inbound reaper's precedent.