fix(api): preserve webhook validation status codes

[r266-tech]

Fixes #3830.

Webhook routes now preserve OperationValidationError.status_code and reason, matching the existing bank route behavior instead of returning a generic 500. Malformed webhook UUID path parameters now return 422 before reaching the engine.

The patch stays local to the five webhook routes and does not change engine validation or persistence behavior.

Tests cover all five validation-error paths plus malformed IDs for delete, update, and delivery listing.

Verification:

• 8 focused HTTP regressions passed
• Ruff check and format passed for both touched files
• git diff --check passed

[strix-security]

Strix Security Review

No security issues found.

_{Updated for ca7fc19.}

---

Reviewed by Strix
_{Re-run review · Configure security review settings}