feat(webhooks): circuit breaker auto-disables misbehaving subscriptions

After DECNET_WEBHOOK_CIRCUIT_THRESHOLD (default 5) consecutive failed
deliveries, the worker calls trip_webhook_circuit(uuid, ts) which
flips enabled=False and stamps auto_disabled_at. The worker sets its
reload flag so the next dispatch epoch stops consuming events for the
tripped sub entirely — one dead receiver can't poison the shared
egress pool anymore.

Operator clears the trip via PATCH — setting enabled=True when the
sub was previously disabled clears auto_disabled_at, zeros
consecutive_failures, and clears last_error. Admin-pause → re-enable
hits the same path harmlessly.

Three observable states now distinguishable in the UI:
- Active              enabled=True,  auto_disabled_at=NULL
- Admin-paused        enabled=False, auto_disabled_at=NULL
- Tripped             enabled=False, auto_disabled_at=<ts>

UI surfaces a TRIPPED · <ts> chip on the row (red, alert-styled) and
a "N TRIPPED" count in the page header. Hover tooltip tells the
operator how to reset ("Re-enable via Edit").

record_webhook_failure now returns the new consecutive_failures count
so the worker can compare against the threshold without a second
roundtrip. trip_webhook_circuit is idempotent — re-tripping just
re-stamps auto_disabled_at.

Closes THREAT_MODEL WH-02 and DEBT-037 §1.

decnet/web/router/webhooks/api_manage_webhooks.py

@@ -173,6 +173,15 @@ async def api_update_webhook(
 
     if req.enabled is not None:
         patch["enabled"] = req.enabled
+        # Re-enabling after a circuit trip clears the trip stamp and
+        # zeros the failure count — the operator has acknowledged and
+        # is ready to resume delivery. Admin-paused → re-enabled also
+        # hits this path harmlessly (auto_disabled_at is already NULL
+        # and consecutive_failures is already 0).
+        if req.enabled is True and not current.get("enabled"):
+            patch["auto_disabled_at"] = None
+            patch["consecutive_failures"] = 0
+            patch["last_error"] = None
 
     if req.simple_events is not None or req.topic_patterns is not None:
         # Re-merge using whatever the caller supplied; a caller that wants