A webhook workflow cannot be created here: no Published trigger, and no way to enter a Secret

A site cannot be wired to invalidate its cache from this console, and the failure is silent.

barakoPress tells a site owner to create one workflow: trigger `Published` on the post type, one
Webhook action with a `Url` and a `Secret`. Neither half can be done here.

## The Published trigger is not offered

`src/app/(admin)/workflows/new/page.tsx:147-153` lists exactly three kinds of option:

```tsx
Created
Updated
{transitions.map((t) => ...)}
```

`Published` is missing, although `src/types/workflow.ts:21` has it in the union and the API fires
it: `WorkflowProjection.cs` maps `ContentStatusChanged` to `Published`. So the one trigger that
means "this is now live on the site" is the one a person cannot pick.

## An optional parameter cannot be entered

`addAction` seeds the form from the action's required parameters only:

```ts
const parameters = Object.fromEntries((meta?.requiredParameters ?? []).map((p) => [p, '']));
```

`WebhookAction` declares `RequiredParameters = new[] { "Url" }`, so no `Secret` input is ever
rendered, and there is no way to add a parameter by hand. Every webhook created in this console is
unsigned.

## What the two add up to

An owner following barakoPress's instructions gets, at best, an unsigned webhook on the wrong
trigger. barakoPress answers an unsigned delivery with 401, so the cache is never invalidated. The
site still works, because it has a time backstop, so the only symptom is that publishing feels
slow and there are 401s in a delivery log nobody opens. That is a worse failure than an error.

The workaround today is POSTing a workflow definition by hand with a JWT, and Swagger is off in the
shipped compose. "Configuration, not code" is not true while that is the path.

## Done when

- `Published` is selectable as a trigger, alongside Created, Updated and the type's transitions
- an action's optional parameters can be entered, not only its required ones. The action metadata
would need to describe them, which is an API change: `WorkflowActionResponse` reports
`requiredParameters` and nothing else.
- a secret-shaped parameter is masked on entry and not echoed back on read, matching how the API
already treats it (encrypted at rest, `secretSet: true` on read)
- creating the barakoPress invalidation workflow is possible start to finish in the console, and
the steps are short enough to put in a README

Start in src/app/(admin)/workflows/new/page.tsx, then read src/types/workflow.ts and trace the Published mapping in WorkflowProjection.cs. Follow addAction and the WebhookAction metadata through the WorkflowActionResponse API contract. Done means Published and optional masked parameters work in the console, the barakoPress workflow can be created end to end, and the README steps are short.

Written by the indexing model from the issue text.