feat(web-security): add webhook.site API key support to callback tool

[GangGreenTemperTatum]

Summary

webhook.site now paywalls token creation, which broke the primary OOB callback provider in the web-security capability. This adds API-key support so the callback tool keeps working with a paid webhook.site account, while preserving anonymous behavior and the interactsh fallback when no key is configured.

Verified live against the webhook.site API:

• Anonymous POST /token still returns 201 but is rate-limited.
• Authenticated (paid Basic) accounts are capped at 1 token per account — a second create returns {"success":false,"error":{"message":"Basic subscriptions can only have 1 URL per account, upgrade to continue"}}.
• Authenticated tokens require the Api-Key header to poll (require_auth: true; polling without the key 302-redirects).

Changes (tools/callback.py)

• API key sourcing — _resolve_webhook_site_api_key() reads WEBHOOK_SITE_API_KEY (canonical), with WEBHOOKSITE_API_KEY and WEBHOOK_API_KEY as aliases, from env or .env. Follows the same convention as the existing AgentMail tool.
• Auth header — the key is sent as Api-Key on every webhook.site request (create, list, poll).
• Token reuse — when creation is rejected due to the Basic one-token cap, _reuse_webhook_site_token() lists the account's tokens and adopts the existing one instead of failing.
• No regression — with no key, behavior is unchanged (anonymous token creation, interactsh fallback). Reuse is never attempted without a key.
• get_callback_url now reports webhook_site (authenticated) vs (anonymous); reset_callback clears the cached key.

Testing

• 14 new unit tests (69 total, all passing) covering key resolution/precedence, auth headers, capped-token reuse, anonymous no-reuse safety, and poll header attachment.
• Live end-to-end with a temporary key: authenticated register → real callback hit → check_callbacks retrieval; the capped-account reuse path; and the anonymous path — all verified against the real API.
• ruff clean on callback.py (the 2 pre-existing E402 in the test file come from the intentional sys.path setup and are unrelated).

Docs

• Updated agents/web-security.md to document WEBHOOK_SITE_API_KEY and the Basic-tier token-reuse behavior.