[scanner] dashboard: Settings → Forge App → GitHub webhooks card (payload URL, events, generate secret, create hook, live status) #18029

Part of #18017 (child 4 of 5). Blocked by #18026.

Add a GitHub webhooks card under Settings → Forge App in the dashboard (find the Forge App settings rendering via grep -rn "Forge App" src/pkg/dashboard and the forge-apps card JS it drives; follow that card's markup, fetch and error-handling pattern exactly). Driven entirely by GET /api/config/github/webhooks (#18026):

• Shows the exact payload URL (copy button), content type application/json, the events to tick (from events), and the verification mode: relay → "This hive receives deliveries through the hub relay; nothing to configure, verify below"; direct → configured; none → set-up steps.
• Generate secret button → POST /api/config/github/webhooks/secret; show the returned secret once with a copy control and a "shown once, store it in the GitHub webhook form" notice; disabled with an explanation when secret_source is env.
• Create webhook for me button (POST .../webhooks/create, ✨ config: add project.reference_repos with tier validation and ReferenceRepoTier accessor #18027 if that child exists, otherwise hidden) rendered only when app_hook_permissions grants the scope; otherwise a one-line hint naming the App permission to grant.
• Live status from health: "N events in the last hour, last at …" or "no events yet — send a test delivery from GitHub's webhook page" when events_1h == 0.
• Link to the owner guide (src/docs/webhooks.md, owner section added in child 5).

Tests: extend the Settings parity test (github_settings_parity_test.go) so the new card's endpoints are listed, and a handler/template test that the card renders the relay copy for verification: relay and the setup copy for none. Changelog fragment (single - bullet).

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88