fix: template webhooks fire (B1) + reject path traversal in import (B7)

[ball42]

Fixes the flagship template-webhooks bug (internal ref J3 / B1) plus a path-traversal hardening (B7) found alongside it. Verified against the smoke harness added in #62.

B1 — template webhooks never fired

Enabled/imported template webhooks were registered without auth fields, so the receiver's validate_webhook compared missing keys against the "null" no-auth sentinel and always returned 401 — every template webhook silently never triggered. Root cause: template_view bypassed bin/data_store with private JSON helpers that omitted the auth-field shape.

• Write-side: template_view now persists webhooks through bin/data_store.add_webhook with the canonical webhook_username/webhook_password/api_key shape (defaulting to the "null" no-auth sentinel, matching the automation handlers). The private _load_webhooks/_register_webhook helpers are removed.
• Read-side: validate_webhook now defaults missing auth keys to "null", so an entry lacking them degrades to the documented open-webhook behavior instead of a silent 401. Previously-broken template webhooks self-heal on upgrade.
• Script execution: template webhooks now store the absolute script path (matching the automation handlers), so the receiver's script execution actually runs them.

B7 — path traversal in template import

.jawa.json package import wrote the uploaded script to an unsanitized path. Import now rejects filenames containing path traversal (via secure_filename) before any file is written.

Tests

New tests/test_templates.py (enable→fire, import→triggerable, canonical shape, no-direct-IO guard, traversal rejection) and an added receiver test for the missing-key self-heal. Full suite green (65 passed, 2 xfailed), ruff clean.

Notes

• Template webhooks are open (no-auth) by default in this release; authenticated-by-default templates are planned for a future release.
• Targets develop for the batched v3.2 release.