feat(security): mask saved webhook URLs instead of returning encrypted values

Encrypted webhook URLs are no longer returned to the frontend. Both user
and admin webhook fields now show '••••••••' as a placeholder when a URL
is already saved, and the sentinel value is skipped on save/test so the
stored secret is never exposed or accidentally overwritten.

server/src/services/settingsService.ts

@@ -7,6 +7,10 @@ export function getUserSettings(userId: number): Record<string, unknown> {
   const rows = db.prepare('SELECT key, value FROM settings WHERE user_id = ?').all(userId) as { key: string; value: string }[];
   const settings: Record<string, unknown> = {};
   for (const row of rows) {
+    if (ENCRYPTED_SETTING_KEYS.has(row.key)) {
+      settings[row.key] = row.value ? '••••••••' : '';
+      continue;
+    }
     try {
       settings[row.key] = JSON.parse(row.value);
     } catch {