fix(webhooks): escape webhook_uri, lazy logging, document 401 header omission

Address round-5 reviewer feedback on PR #747:

- Escape `webhook_uri` in the admin pane HTML template so an operator-
  controlled env value (`WEBHOOK_INTERNAL_URL`, `NEXTCLOUD_MCP_SERVER_URL`)
  can't inject markup. The sibling `preset_id` and exception messages were
  already escaped — this one was the odd one out.
- Convert the eight remaining f-string `logger.warning`/`logger.error`
  calls in `api/webhooks.py` to lazy `%s` formatting, matching the style
  already adopted by `webhook_receiver.py` and `webhook_routes.py`.
- Document why the 401 from `handle_nextcloud_webhook` deliberately omits
  `WWW-Authenticate`: NC's webhook delivery worker has no auth-flow state
  machine to negotiate against, the bearer is a static shared secret
  configured out-of-band via `WEBHOOK_SECRET`, and a challenge response
  wouldn't change client behaviour. The existing warning log already
  records the rejection.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

nextcloud_mcp_server/vector/webhook_receiver.py

@@ -60,6 +60,13 @@ async def handle_nextcloud_webhook(request: Request) -> JSONResponse:
         # for differing lengths but isn't fully constant-time across them;
         # that's fine here — a secret length leak is not a sensitive signal.
         if not hmac.compare_digest(provided, expected):
+            # Intentionally omit WWW-Authenticate. RFC 7235 §4.1 says a 401
+            # SHOULD carry it, but Nextcloud's webhook delivery worker has no
+            # auth-flow state machine to negotiate against — the bearer is a
+            # static shared secret configured out-of-band via WEBHOOK_SECRET,
+            # and a challenge response wouldn't change client behaviour.
+            # Surfacing it would only mislead operators into expecting a
+            # renegotiation that doesn't exist.
             logger.warning("Webhook rejected: missing or invalid Authorization header")
             return JSONResponse(
                 {"status": "unauthorized"},