tighten permission checks and input validation across the api

src/routes/api/git/stacks/+server.ts

@@ -15,6 +15,7 @@ import { authorize } from '$lib/server/authorize';
 import { registerSchedule } from '$lib/server/scheduler';
 import { auditGitStack } from '$lib/server/audit';
 import { createJobResponse } from '$lib/server/sse';
+import { allowSecretlessWebhook, webhookConfigRequiresSecret } from '$lib/server/webhook-secret-policy';
 
 // Stack name validation: Docker Compose requires lowercase; must start with a
 // letter or number, and contain only lowercase letters, numbers, hyphens, underscores
@@ -104,7 +105,7 @@ export const POST: RequestHandler = async (event) => {
 		}
 
 		// A secret is mandatory when the webhook is enabled.
-		if (data.webhookEnabled && !data.webhookSecret?.trim()) {
+		if (webhookConfigRequiresSecret(!!data.webhookEnabled, !!data.webhookSecret?.trim(), allowSecretlessWebhook())) {
 			return json({ error: 'A webhook secret is required when the webhook is enabled' }, { status: 400 });
 		}