Arm a one-shot capture of the next real webhook delivery

Arms this workflow to CAPTURE the next delivery to its public webhook URL, for 120 seconds. This is how you get a real provider's payload into the editor without publishing.

What a caller must know:

• There is no separate test URL. testUrl is the workflow's own webhook path (/api/webhooks/{webhookToken}) — the same address a producer is already registered against. It is returned as a PATH, not an absolute URL; prefix it with the API's public base.
• It is one-shot: the first delivery disarms the listener, so a retry or a refresh cannot double-fire. It also expires by itself after expiresInSeconds.
• What happens on that delivery depends on publication state. If the workflow is NOT active, the delivery runs the DRAFT and is recorded as environment: "test", triggerType: "webhook" — honestly both. If the workflow IS active, the delivery is an ordinary production run; arming does not divert it.
• Watch the outcome on GET /api/workflows/{id}/listen-stream, which pushes a test_event_captured event carrying runId and the captured triggerData.
• Arming requires Redis; without it this is 503.
• No request body is read. Re-arming simply restarts the 120-second window.