PublicWebhookSubscriptionWithSecretDto

Returned exactly once on create / rotate-secret. Receivers verify webhooks via
HMAC-SHA256 of {timestamp}.{body} using API.Features.PublicApi.V1.PublicWebhookSubscriptionWithSecretDto.SigningSecret.
The secret is never re-exposed; rotate to get a fresh value.

{ "subscription": { "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "url": "string", "eventTypes": [ "string" ], "description": "string", "isActive": true, "disabledForFailures": true, "consecutiveFailures": 0, "lastDeliveryAt": "2019-08-24T14:15:22.123Z", "createdAt": "2019-08-24T14:15:22.123Z" }, "signingSecret": "string" }