security(webhooks): restrict all webhook endpoints to admin-only

fix(qa): pass technique_id and test_id context between test suites
fix(qa): playbook creation requires technique_id field
fix(qa): lesson creation requires what_happened and root_cause fields
fix(qa): campaign complete test now activates with test before completing
fix(qa): rate limit test notes loopback exemption instead of failing

backend/app/routers/webhooks.py

@@ -52,7 +52,7 @@ def list_webhooks_route(
     offset: int = 0,
     limit: int = 50,
     db: Session = Depends(get_db),
-    current_user: User = Depends(require_any_role("red_lead", "blue_lead")),
+    current_user: User = Depends(require_any_role("admin")),
 ):
     """Return all webhook configurations. **Requires admin role.**"""
     webhooks = list_webhooks(db, offset=offset, limit=limit)
@@ -68,7 +68,7 @@ def list_webhooks_route(
 def create_webhook_route(
     payload: WebhookConfigCreate,
     db: Session = Depends(get_db),
-    current_user: User = Depends(require_any_role("red_lead", "blue_lead")),
+    current_user: User = Depends(require_any_role("admin")),
 ):
     """Create a new webhook configuration. **Requires admin role.**"""
     with UnitOfWork(db) as uow:
@@ -87,7 +87,7 @@ def create_webhook_route(
 def get_webhook_route(
     webhook_id: uuid.UUID,
     db: Session = Depends(get_db),
-    current_user: User = Depends(require_any_role("red_lead", "blue_lead")),
+    current_user: User = Depends(require_any_role("admin")),
 ):
     """Return a single webhook configuration. **Requires admin role.**"""
     wh = get_webhook_or_raise(db, webhook_id)
@@ -104,7 +104,7 @@ def update_webhook_route(
     webhook_id: uuid.UUID,
     payload: WebhookConfigUpdate,
     db: Session = Depends(get_db),
-    current_user: User = Depends(require_any_role("red_lead", "blue_lead")),
+    current_user: User = Depends(require_any_role("admin")),
 ):
     """Update one or more fields of a webhook configuration. **Requires admin role.**"""
     with UnitOfWork(db) as uow:
@@ -123,7 +123,7 @@ def update_webhook_route(
 def delete_webhook_route(
     webhook_id: uuid.UUID,
     db: Session = Depends(get_db),
-    current_user: User = Depends(require_any_role("red_lead", "blue_lead")),
+    current_user: User = Depends(require_any_role("admin")),
 ):
     """Hard-delete a webhook configuration. **Requires admin role.**"""
     with UnitOfWork(db) as uow:
@@ -140,7 +140,7 @@ def delete_webhook_route(
 def test_webhook_route(
     webhook_id: uuid.UUID,
     db: Session = Depends(get_db),
-    current_user: User = Depends(require_any_role("red_lead", "blue_lead")),
+    current_user: User = Depends(require_any_role("admin")),
 ):
     """Send a test ping to the webhook endpoint. **Requires admin role.**"""
     # Verify the webhook exists before dispatching