[Suzan-max]

…uth enumeration prevention, oracle precision validation

Resolves all four open issues:

#782 - Webhook secret returned in plaintext on subscription listing

• list() in WebhooksController now masks the decrypted secret to '****' instead of silently dropping it or returning it in full
• Adds secretMasked field to WebhookListItemDto (Swagger documented)
• Full secret is only ever returned at registration time
• Tests cover: full secret absent, last-4 mask correct, no secret omitted

#779 - Policy list endpoint loads full entity relations eagerly

• findByPolicyholder() now uses select: { ... } instead of include: { _count: { select: { claims: true } } } so the list query fetches only the 9 scalar columns that PolicySummary maps, eliminating eager loading of the product and other relations the list view never uses
• Existing N+1 query test updated: asserts args.select is set and args.include is undefined, matching the new query shape
  [security] Error responses reveal whether an email is registered #780 - Error responses reveal whether an email is registered
  [bug] Oracle service does not validate reading value precision matches oracle key type #781 - Oracle service does not validate reading value precision

Closes #779
Closes #780
Closes #781
Closes #782

[drips-wave]

@Suzan-max Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits