fix: webhook update sends a body ClickUp accepts

[pikonha]

webhook update could not repoint a webhook's endpoint. Found while moving a live subscription between two agents; the workaround was a raw curl PUT.

Three bugs, all in the request body

1. Events was typed string. ClickUp wants an array:

body	result
{"events":"taskStatusUpdated"}	400 {"err":"Invalid events","ECODE":"OAUTH_150"}
{"events":["taskStatusUpdated"]}	200

webhook list returns an array, so round-tripping a value the API just gave you failed. create already had this right (StringSlice); only update did not.

2. No omitempty. An endpoint-only update sent "status": "" and "events": "" along with it:

body	result
{"endpoint":"…"}	200
{"endpoint":"…","status":""}	500 {"err":"Internal Server Error","ECODE":"OAUTH_152"}

The endpoint-only update the CLI could not do is one the API accepts happily. PUT /v2/webhook/{id} behaves like PATCH — it preserves every field the body omits — so omitempty across the struct is the whole fix.

3. --events '*' silently unsubscribes. The flag help said "use * for all". ClickUp answers 200 and sets events: [] — subscribing to nothing:

{"events":["*"]}  → 200, events = []
{"events":"*"}    → 200, events = []

That is a live webhook going quiet with no error to notice. Now refused with a message naming why; the help text no longer recommends it.

Plus: an update with no fields at all is refused instead of sending an empty body.

Verification

TestUpdateWebhookBody asserts the bytes on the wire (endpoint-only omits the other two; events marshal as an array; status alone), because these are payload bugs — asserting on the response would have passed throughout.

Against the live API with a throwaway webhook, since a fake server cannot reproduce OAUTH_150/152:

### endpoint only (was 500)
 endpoint: …/__probe2__ | events: ['taskCreated']        <- events preserved
### events round-trip (was 400)
 events: ['taskStatusUpdated', 'taskUpdated']
### status only
 health: {'fail_count': 0, 'status': 'active'}
### '*' now refused
 VALIDATION_ERROR
### nothing to update
 VALIDATION_ERROR

Throwaway webhook deleted after.

Note on the existing suite

cmd.TestParseSince fails on main at bbfcdff as well — timezone-dependent, unrelated to this change. Everything else passes.

Two things I did not touch

• webhook list prints secret in full. It is the HMAC signing key. Worth redacting by default or gating behind a flag.
• task list --list vs webhook create --list-id - same concept, two flag names.