[scanner] dashboard: POST /api/config/github/webhooks/create — create the org/repo hook through the App when hook permissions are granted #18028

Part of #18017 (child 3 of 5). Blocked by #18026.

Add POST /api/config/github/webhooks/create (owner-only, next to the handlers from #18026) so an owner whose App installation grants hook permissions does not have to create the webhook by hand:

• Body {scope: "org"|"repo", repo?: "owner/name"}. Refuse 412 with a message naming the missing permission when the installation lacks organization_hooks: write (org scope) or repository_hooks: write (repo scope) — read permissions from the installation data already used by forge-apps; never attempt the call blind.
• Refuse 409 when no webhook secret is available (github.WebhookSecret() == "") — the hook must be created with the secret the receiver verifies, so the owner mints first ([scanner] dashboard: owner API GET /api/config/github/webhooks and POST .../webhooks/secret (generate, store 0600, return once) #18026).
• Create the hook through the App installation token: POST /orgs/{org}/hooks or POST /repos/{owner}/{repo}/hooks with config: {url: <payload_url>, content_type: json, secret: <WebhookSecret()>, insecure_ssl: "0"}, events = the receiver's handled-event list (the same exported slice [scanner] dashboard: owner API GET /api/config/github/webhooks and POST .../webhooks/secret (generate, store 0600, return once) #18026 uses), active: true. Go through the package's existing GitHub REST client/budget path (src/pkg/github — grep how forge-apps or the installation lookup issue REST calls), never a raw net/http call with the token.
• Idempotent: if a hook with the same config.url already exists on the target, return it (200) instead of creating a duplicate (list hooks first; list needs the same read permission).
• Response {id, url, events, created: bool}. Audit-log like other owner mutations.

Tests with an httptest GitHub stub: 412 without permission, 409 without secret, creates on first call and returns existing on second, repo scope hits the repo endpoint. Changelog fragment (single - bullet).

Decision taken by hive: hosted spokes already receive hub-relayed deliveries with no owner action, so this endpoint is for self-hosted hives; the GET from #18026 already tells the card whether to show the button.

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88