Self-register this portal's webhook

Subscribe the calling portal's webhook for the authenticated organization.

OAuth-token only: the client is resolved from the token (not the body), the org from the token's org claim — a portal can only ever register its own webhook, for orgs that consented to it.