Support independently rotated webhook credentials bound to source profiles

Problem/Motivation

Alpha2 supports source policy mappings and one credential pair with a shared allowlist. Sites receiving events from multiple Postmark servers cannot rotate or revoke one source's credential independently.

Proposed resolution

Introduce optional named source profiles that bind a credential to allowed server/stream pairs. Keep secret material in trusted settings or a supported secret-provider integration, not exported configuration.

Acceptance criteria

• Authenticate the credential and then enforce only that profile's source bindings; reject cross-profile payloads before storage.
• Provide independent current/previous credentials with fixed overlap expiry and explicit profile revocation.
• Preserve the existing shared-endpoint setup through an explicit backward-compatible migration path.
• Define duplicate/ambiguous profile handling, malformed configuration behavior and source-less provider verification payload behavior.
• Test rotation, revocation, profile confusion, mixed-source attacks and absence of secret values in URLs, forms, logs and exports.

Scope and dependencies

Optional follow-up after stable release; not a blocker for #3621224: Complete the 1.0.0 stable release verification gates. Builds on #3621132: Scope webhook sources and suppression policy by server and message stream; the completed original issue remains fixed.