fix: authorize webhook trigger targets

[yaojin3616]

Summary

• Resolve webhook token matches through a constrained DAO query instead of loading every enabled trigger.
• Require a non-deleted Agent in an active Tenant before accepting a webhook.
• Add regression coverage for targets rejected by authorization.

Verification

• PYTHONPATH=. uv run python -m pytest tests/test_webhooks_api.py
• PYTHONPATH=. uv run python -m ruff check app/api/webhooks.py app/dao/trigger_dao.py tests/test_webhooks_api.py

Closes #166