webhooks

Turns a POST from Zapier (or anything else that can send a JSON webhook — monday.com and HubSpot both go through a Zapier "Webhooks by Zapier" step in the published recipe, see docs) into a draft rule, exactly as if a human had called POST /v1/rules by hand. Sanitize, tenant scoping, and the draft-rule shape are shared with that endpoint via create_draft_rule — this only adds a different front door onto it.

The per-IP rate limit (enforce_webhook_ingest_ip_rate_limit) runs as a route-level dependency, ahead of everything below, specifically so a flood of requests with invalid/guessed tokens gets throttled before spending a token-hash lookup or a DB round trip on each one — same reasoning as checking it before, not after, resolving the token.