fix(security): require WEBHOOK_SECRET for the Nextcloud webhook receiver

GHSA-8vh3-g2qg-2h2c (CVSS 9.1, CWE-306): POST /webhooks/nextcloud had no
authentication when WEBHOOK_SECRET was unset (the default). The receiver
trusted the attacker-supplied user.uid and fed it to Qdrant, letting an
unauthenticated network caller delete or re-index any user's vector
embeddings.

Webhooks now require WEBHOOK_SECRET end-to-end:

- app.py: the /webhooks/nextcloud route is only mounted when WEBHOOK_SECRET
  is set; otherwise it 404s and a startup warning notes vector sync falls
  back to the polling scanner.
- webhook_receiver.py: removed the warn-and-accept fallback. No secret -> 503,
  missing/invalid bearer -> 401; the payload is never processed unauthenticated.
- webhook_routes.py / api/webhooks.py: webhook_auth_pair() raises
  WebhookSecretNotConfigured instead of returning authMethod="none"; both
  registration entry points return a clear 503 so no dead unauthenticated
  webhooks are created.

Also expose webhooks availability to the Astrolabe UI via GET /api/v1/status
("webhooks_enabled": bool), set WEBHOOK_SECRET on the docker-compose
semantic-search dev services, and update env.sample + ADR-010 / ADR-018 /
webhook-management-guide docs.

Vector sync still works without a secret via the polling scanner.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

nextcloud_mcp_server/auth/webhook_routes.py

@@ -125,21 +125,40 @@ def _get_webhook_uri() -> str:
     return "http://localhost:8000/webhooks/nextcloud"
 
 
-def webhook_auth_pair() -> tuple[str, dict[str, str] | None]:
+class WebhookSecretNotConfigured(RuntimeError):
+    """Raised when a webhook registration is attempted without WEBHOOK_SECRET.
+
+    Webhooks require ``WEBHOOK_SECRET`` (GHSA-8vh3-g2qg-2h2c): the receiver
+    route is not mounted without it, so registering a webhook would only create
+    an unauthenticated delivery target pointing at a non-existent endpoint.
+    """
+
+
+def webhook_auth_pair() -> tuple[str, dict[str, str]]:
     """Resolve ``(auth_method, auth_data)`` for new webhook registrations.
 
-    When ``WEBHOOK_SECRET`` is set, returns
-    ``("header", {"Authorization": f"Bearer {secret}"})`` so NC stores the
-    credential encrypted at-rest and forwards it on every delivery. When
-    unset, returns ``("none", None)`` — backward-compatible with deployments
-    that haven't rolled out webhook auth yet.
+    Returns ``("header", {"Authorization": f"Bearer {secret}"})`` so NC stores
+    the credential encrypted at-rest and forwards it on every delivery.
+
+    ``WEBHOOK_SECRET`` is required (GHSA-8vh3-g2qg-2h2c): the receiver refuses
+    unauthenticated deliveries and ``app.py`` does not mount the route without
+    a secret, so registering an ``authMethod="none"`` webhook would only create
+    a dead, unauthenticated delivery target. Callers must surface
+    :class:`WebhookSecretNotConfigured` as a clear operator-facing error.
 
     Shared by both registration call sites: the ``/app/webhooks`` preset
     flow and the Astrolabe-facing ``/api/v1/webhooks`` endpoint.
+
+    Raises:
+        WebhookSecretNotConfigured: when ``WEBHOOK_SECRET`` is unset.
     """
     secret = get_settings().webhook_secret
     if not secret:
-        return ("none", None)
+        raise WebhookSecretNotConfigured(
+            "WEBHOOK_SECRET must be set to register webhooks. Without it the "
+            "/webhooks/nextcloud receiver is disabled and any registration "
+            "would point at a non-existent, unauthenticated endpoint."
+        )
     return ("header", {"Authorization": f"Bearer {secret}"})
 
 
@@ -151,13 +170,16 @@ async def _register_preset_webhooks(
     """Register every event in a preset against a single MCP webhook URI.
 
     Threads the resolved ``(auth_method, auth_data)`` from
-    :func:`webhook_auth_pair` onto each registration call so deliveries
-    carry the configured ``Authorization`` header (when ``WEBHOOK_SECRET``
-    is set) or fall through to ``authMethod="none"`` (backward-compatible
-    when it's not).
+    :func:`webhook_auth_pair` onto each registration call so deliveries carry
+    the configured ``Authorization`` header. ``WEBHOOK_SECRET`` is required
+    (GHSA-8vh3-g2qg-2h2c): with no secret this raises
+    :class:`WebhookSecretNotConfigured` before any webhook is created.
 
     Extracted from :func:`enable_webhook_preset` so the auth-threading
     behaviour is testable without standing up a Starlette app.
+
+    Raises:
+        WebhookSecretNotConfigured: when ``WEBHOOK_SECRET`` is unset.
     """
     auth_method, auth_data = webhook_auth_pair()
     registered_ids: list[int] = []
@@ -498,6 +520,16 @@ async def enable_webhook_preset(request: Request) -> HTMLResponse:
             """
         )
 
+    except WebhookSecretNotConfigured as e:
+        logger.warning("Refusing to enable preset %s: %s", preset_id, e)
+        return HTMLResponse(
+            content=(
+                '<div class="warning">Webhooks are disabled: WEBHOOK_SECRET is '
+                "not set. Configure it and restart the server to enable webhook "
+                "presets.</div>"
+            ),
+            status_code=503,
+        )
     except Exception as e:
         logger.error("Failed to enable preset %s: %s", preset_id, e, exc_info=True)
         return HTMLResponse(