Add GET /my_packages/:name/webhook status endpoint

[AMDphreak]

Summary

• Add authenticated GET /my_packages/:packname/webhook returning JSON {package,configured} without regenerating the secret
• Add hasPackageSecret on the DB/registry layers
• Document the endpoint in api-docs/http-update.md

Fixes #617

Motivation

Owner tooling (e.g. dub-publish) needs to check whether webhooks are enabled. The only existing owner HTTP actions are regen_secret (destructive rotate) and unset_secret. Scraping the My packages HTML works but is fragile; calling regen_secret to check status invalidates forge webhook URLs.

Plaintext secrets remain one-shot after regenerate — this endpoint only exposes a boolean.

Test plan

• As package admin, GET /my_packages/:name/webhook with session cookie returns configured:false before enable
• After Enable Webhooks / regen_secret, same GET returns configured:true
• Non-admin / unauthenticated requests are rejected
• Response never includes the plaintext secret