Encrypt webhook URLs with DPAPI via Credential Manager

[erikdarlingdata]

Summary

• Moves Teams and Slack webhook URLs from plaintext settings.json / preferences.json to Windows Credential Manager (DPAPI-encrypted)
• Follows the existing pattern used for SMTP passwords and SQL Server credentials
• Automatic migration: on first settings load, any plaintext URLs are moved to Credential Manager and stripped from the JSON file
• Both Dashboard and Lite editions updated

Closes #848

Test plan

• Both editions build with 0 warnings, 0 errors
• Migration: With an existing webhook URL in settings.json/preferences.json, open Settings — URL should appear in the textbox and be removed from the JSON file
• Save: Enter a new webhook URL, save settings, verify it persists across app restarts
• Send: Verify Teams/Slack test messages still send successfully
• Clean install: Fresh install with no prior webhook config — settings should load cleanly

cc @jakemorgangit — you built the webhook feature (#725), could you help test this with your Teams/Slack setup?

🤖 Generated with Claude Code