feat(security): mask saved webhook URLs instead of returning encrypted values

Encrypted webhook URLs are no longer returned to the frontend. Both user
and admin webhook fields now show '••••••••' as a placeholder when a URL
is already saved, and the sentinel value is skipped on save/test so the
stored secret is never exposed or accidentally overwritten.

server/src/routes/settings.ts

@@ -14,6 +14,7 @@ router.put('/', authenticate, (req: Request, res: Response) => {
   const authReq = req as AuthRequest;
   const { key, value } = req.body;
   if (!key) return res.status(400).json({ error: 'Key is required' });
+  if (value === '••••••••') return res.json({ success: true, key, unchanged: true });
   settingsService.upsertSetting(authReq.user.id, key, value);
   res.json({ success: true, key, value });
 });