A webhook endpoint. signing_secret is returned by create/2, get/2 and
rotate/3; status is "enabled" | "disabled". previous_secret_expires_at
(get/2, rotate/3) is the ISO instant until which deliveries are also
signed with the secret the current one replaced, nil outside a rotation's
overlap window. remove/2 populates id plus deleted.