List webhook endpoints

curl "https://herculeradar.com/api/v1/webhooks" \
  --header "Authorization: Bearer hr_live_…"

Tool name list_webhooks. It takes the same input and returns the same { data, meta } envelope as REST, because both call the same function.

Outbound endpoints. Secrets are never returned after create.

{
  "data": {
    "webhooks": [
      {
        "id": "uuid",
        "url": "https://hooks.example/hr"
      }
    ]
  },
  "meta": {
    "capability": "list_webhooks",
    "requestId": "req_9f2b4a8c1d0e",
    "idempotencyReplayed": false,
    "docs": "https://herculeradar.com/docs/reference/list_webhooks"
  }
}

Requires the webhooks:read scope. A credential without it gets 403 FORBIDDEN. Resources in projects the credential cannot reach answer 404 NOT_FOUND rather than 403, so ids cannot be probed across tenants.