feat: REST API for subscription lifecycle (create, list, update, delete)

[cokehill]

Summary

Developers need a clean REST API to manage subscriptions from their own apps or CI pipelines,
without needing to open the dashboard.

Acceptance criteria

• GET /api/subscriptions — list all subs for authenticated key
• POST /api/subscriptions — create, returns 201 with full object
• GET /api/subscriptions/:id — get single sub (403 if wrong key)
• PATCH /api/subscriptions/:id — toggle active, update label or channel_config
• DELETE /api/subscriptions/:id — removes from DB and closes stream
• Hot-reload: stream opens/closes immediately without restart
• Integration tests using supertest for all five endpoints

Request/response shape

See README for examples. Filter and channel_config are JSON objects — store as serialised
strings in SQLite, deserialise on read.