feat(webhooks): circuit breaker auto-disables misbehaving subscriptions

After DECNET_WEBHOOK_CIRCUIT_THRESHOLD (default 5) consecutive failed
deliveries, the worker calls trip_webhook_circuit(uuid, ts) which
flips enabled=False and stamps auto_disabled_at. The worker sets its
reload flag so the next dispatch epoch stops consuming events for the
tripped sub entirely — one dead receiver can't poison the shared
egress pool anymore.

Operator clears the trip via PATCH — setting enabled=True when the
sub was previously disabled clears auto_disabled_at, zeros
consecutive_failures, and clears last_error. Admin-pause → re-enable
hits the same path harmlessly.

Three observable states now distinguishable in the UI:
- Active              enabled=True,  auto_disabled_at=NULL
- Admin-paused        enabled=False, auto_disabled_at=NULL
- Tripped             enabled=False, auto_disabled_at=<ts>

UI surfaces a TRIPPED · <ts> chip on the row (red, alert-styled) and
a "N TRIPPED" count in the page header. Hover tooltip tells the
operator how to reset ("Re-enable via Edit").

record_webhook_failure now returns the new consecutive_failures count
so the worker can compare against the threshold without a second
roundtrip. trip_webhook_circuit is idempotent — re-tripping just
re-stamps auto_disabled_at.

Closes THREAT_MODEL WH-02 and DEBT-037 §1.

decnet/web/db/repository.py

@@ -466,5 +466,12 @@ class BaseRepository(ABC):
 
     async def record_webhook_failure(
         self, uuid: str, ts: Any, error: str
-    ) -> None:
+    ) -> int:
+        """Record a failed delivery; return the new ``consecutive_failures``
+        count so the caller can decide whether to trip the circuit."""
+        raise NotImplementedError
+
+    async def trip_webhook_circuit(self, uuid: str, ts: Any) -> None:
+        """Auto-disable a subscription after repeated failures. Sets
+        ``enabled=False`` and stamps ``auto_disabled_at``."""
         raise NotImplementedError