POST /v1/webhooks with url and events (variant.published, variant.updated, price.updated). Deliveries are signed with X-Truckaurbus-Signature (HMAC-SHA256 of the body with the secret returned at creation) and retried on failure. GET /v1/webhooks lists, DELETE /v1/webhooks/{id} removes.