Inbound webhook — first sample capture

Public endpoint to receive the first JSON payload for a webhook data source. Requires `X-Webhook-Secret` header. Only `application/json` content is accepted. Captures the first sample within a 5-minute window after creation, activates the data source, and auto-creates a dataset.

curl -X POST "https://example.com/hooks/string" \  -H "X-Webhook-Secret: string" \  -H "Content-Type: application/json" \  -d '{}'

{  "ok": true}