fix(#2164): address argus review — Option<String> secret + stale hook cleanup

Two issues flagged by argus in PR #2388 review:

1. Empty-key fallback: when load_or_generate() failed, webhook_secret was
   String::new(). An attacker knowing this could forge deliveries with a
   valid HMAC of the empty key. Fix: change to Option<String>; on None,
   skip hook registration entirely and return 503 from /webhook/* handlers
   (rather than 401 with a misleadingly-verifiable empty-key HMAC).

2. Stale hook cleanup: on upgrade from old code, old loopback hooks
   (http://127.0.0.1:.../webhook/knowledge, .../webhook/config-pr) were
   left alongside the new domain-URL hook. Fix: during ensure_webhook /
   ensure_config_pr_webhook, after listing hooks, delete any that end with
   our path suffix but point at a different base URL.

clippy + nix fmt clean.

hive-c0re/src/dashboard/mod.rs

@@ -58,7 +58,9 @@ struct AppState {
     coord: Arc<Coordinator>,
     /// HMAC-SHA256 secret shared with Forgejo webhook registrations.
     /// Verified on every incoming `/webhook/*` POST.
-    webhook_secret: String,
+    /// `None` when the secret could not be loaded at startup — all
+    /// `/webhook/*` requests are rejected with 503 in that case.
+    webhook_secret: Option<String>,
 }
 
 #[allow(
@@ -68,7 +70,11 @@ struct AppState {
               handler; splitting that exhaustive list across helpers would \
               obscure the route map for no readability gain"
 )]
-pub async fn serve(port: u16, coord: Arc<Coordinator>, webhook_secret: String) -> Result<()> {
+pub async fn serve(
+    port: u16,
+    coord: Arc<Coordinator>,
+    webhook_secret: Option<String>,
+) -> Result<()> {
     // API-only: the gateway static-serves the dashboard dist and proxies
     // non-static requests here (see hive-gateway.nix). Unmatched paths 404.
     let app = Router::new()