fix: step 6 webhooks demo - replace 404 events API with webhook registration flow

- Replace /events/v2/* endpoints (404 in sandbox) with /api/v1/webhooks
- Add list_webhooks() and register_webhook() methods to TinkClient
- Step 6 now shows: webhook flow diagram + curl examples + live API + sample payload
- Handle sandbox 404 gracefully (shows example data, no red error)
- Remove .env.production from git tracking (credentials via Gitea secrets)
- deploy.yml: write .env.production from TINK_CLIENT_ID/SECRET secrets

src/templates/step.html

@@ -117,7 +117,7 @@
     {% else %}
     <!-- Not yet connected — show connection UI -->
 
-    <!-- PRIMARY: console.tink.com/callback (always works, no redirect URI registration needed) -->
+    <!-- PRIMARY: direct callback flow -->
     <div class="bg-slate-900 border border-emerald-700/40 rounded-xl p-5 space-y-4">
       <div class="flex items-start gap-3">
         <div class="w-8 h-8 rounded-full bg-emerald-900/50 flex items-center justify-center flex-shrink-0">
@@ -125,7 +125,7 @@
         </div>
         <div>
           <h3 class="text-white font-semibold mb-1">Tilslut testbank</h3>
-          <p class="text-slate-400 text-sm">Åbn Tink Link, forbind Demo Bank, kopier koden og indsæt herunder.</p>
+          <p class="text-slate-400 text-sm">Klik knappen, vælg Demo Bank og log ind — du redirectes automatisk tilbage.</p>
         </div>
       </div>
 
@@ -133,24 +133,22 @@
       <div class="bg-slate-800/60 border border-slate-700/50 rounded-lg p-4 text-sm space-y-2">
         <p class="text-slate-300 font-semibold flex items-center gap-1.5">
           <svg class="w-4 h-4 text-amber-400 flex-shrink-0" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M13 16h-1v-4h-1m1-4h.01M21 12a9 9 0 11-18 0 9 9 0 0118 0z"/></svg>
-          Sådan forbinder du Demo Bank
+          Trin i Tink Link
         </p>
         <ol class="text-slate-400 space-y-1.5 list-decimal list-inside leading-relaxed">
-          <li>Hent credentials fra <span class="font-mono text-amber-300 text-xs bg-slate-900 px-1.5 py-0.5 rounded">Console → Demo Bank → Transactions → DK</span></li>
-          <li>Klik <strong class="text-white">"Åbn Tink Link"</strong> nedenfor (åbner i ny fane)</li>
-          <li>Vælg <span class="text-slate-300">Tink Demo Bank</span> → <span class="text-slate-300">Open Banking</span> → <span class="text-slate-300">Password And OTP</span></li>
-          <li>Indtast username + password → OTP-koden vises på siden</li>
-          <li>Vælg en konto → Continue</li>
-          <li>Du lander på <span class="font-mono text-amber-300 text-xs">console.tink.com/callback<strong>?code=XXXX</strong></span> — kopier koden</li>
-          <li>Indsæt koden i feltet herunder og klik "Brug kode"</li>
+          <li>Vælg <span class="text-slate-300 font-medium">Tink Demo Bank</span></li>
+          <li>Vælg <span class="text-slate-300">Open Banking</span> → <span class="text-slate-300">Password And OTP</span></li>
+          <li>Hent credentials: <span class="font-mono text-amber-300 text-xs bg-slate-900 px-1.5 py-0.5 rounded">Console → Demo Bank → Transactions → DK</span></li>
+          <li>Indtast username + password → OTP vises på siden → Continue</li>
+          <li>Vælg en konto → du redirectes automatisk tilbage her ✓</li>
         </ol>
       </div>
 
       <div class="flex items-center gap-3">
-        <a href="{{ dev_tink_link_url }}" target="_blank"
+        <a href="{{ tink_link_url }}"
            class="inline-flex items-center gap-2 px-5 py-2.5 bg-emerald-600 hover:bg-emerald-500 text-white font-semibold rounded-lg transition">
           Åbn Tink Link
-          <svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M10 6H6a2 2 0 00-2 2v10a2 2 0 002 2h10a2 2 0 002-2v-4M14 4h6m0 0v6m0-6L10 14"/></svg>
+          <svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M14 5l7 7m0 0l-7 7m7-7H3"/></svg>
         </a>
         <a href="/demo/reset"
            class="inline-flex items-center gap-1.5 px-4 py-2.5 border border-slate-700 text-slate-400 hover:text-white hover:border-slate-500 rounded-lg text-sm transition">
@@ -158,36 +156,31 @@
           Start forfra
         </a>
       </div>
-
-      <!-- Code paste form -->
-      <form method="POST" action="/demo/step/3" class="flex gap-2 items-stretch pt-1 border-t border-slate-800">
-        <input type="text" name="code" placeholder="Indsæt code=XXXX her efter Tink Link flow..."
-               class="flex-1 bg-slate-800 border border-slate-700 text-slate-200 rounded-lg px-3 py-2 text-sm font-mono placeholder-slate-600 focus:outline-none focus:border-emerald-600" required>
-        <button type="submit"
-                class="px-4 py-2 bg-emerald-700 hover:bg-emerald-600 text-white text-sm font-semibold rounded-lg transition whitespace-nowrap">
-          Brug kode
-        </button>
-      </form>
     </div>
 
-    <!-- SECONDARY: direct callback (only works when redirect URI is registered) -->
-    {% if tink_link_url %}
+    <!-- FALLBACK: console.tink.com/callback + manual code paste -->
     <details class="bg-slate-900 border border-slate-700/30 rounded-xl overflow-hidden">
       <summary class="px-5 py-3 cursor-pointer text-slate-500 hover:text-slate-400 text-xs flex items-center gap-2 select-none">
         <svg class="w-3.5 h-3.5" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M10.325 4.317c.426-1.756 2.924-1.756 3.35 0a1.724 1.724 0 002.573 1.066c1.543-.94 3.31.826 2.37 2.37a1.724 1.724 0 001.065 2.572c1.756.426 1.756 2.924 0 3.35a1.724 1.724 0 00-1.066 2.573c.94 1.543-.826 3.31-2.37 2.37a1.724 1.724 0 00-2.572 1.065c-.426 1.756-2.924 1.756-3.35 0a1.724 1.724 0 00-2.573-1.066c-1.543.94-3.31-.826-2.37-2.37a1.724 1.724 0 00-1.065-2.572c-1.756-.426-1.756-2.924 0-3.35a1.724 1.724 0 001.066-2.573c-.94-1.543.826-3.31 2.37-2.37.996.608 2.296.07 2.572-1.065z"/><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M15 12a3 3 0 11-6 0 3 3 0 016 0z"/></svg>
-        Direkte callback (kræver registreret redirect URI i Console)
+        Alternativ: manuel kode-indsætning via console.tink.com
         <span class="ml-auto">▾</span>
       </summary>
-      <div class="px-5 pb-4 pt-3 border-t border-slate-800">
-        <p class="text-slate-500 text-xs mb-3">Virker kun når <code class="text-slate-400">{{ tink_link_url | truncate(60) }}</code> er registreret som redirect URI i Tink Console.</p>
-        <a href="{{ tink_link_url }}"
+      <div class="px-5 pb-4 pt-3 border-t border-slate-800 space-y-3">
+        <a href="{{ dev_tink_link_url }}" target="_blank"
            class="inline-flex items-center gap-2 px-4 py-2 bg-slate-700 hover:bg-slate-600 text-slate-300 text-sm rounded-lg transition">
-          Åbn med direkte callback
+          Åbn med console callback
           <svg class="w-3.5 h-3.5" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M10 6H6a2 2 0 00-2 2v10a2 2 0 002 2h10a2 2 0 002-2v-4M14 4h6m0 0v6m0-6L10 14"/></svg>
         </a>
+        <form method="POST" action="/demo/step/3" class="flex gap-2 items-stretch">
+          <input type="text" name="code" placeholder="Indsæt code=XXXX fra console.tink.com/callback..."
+                 class="flex-1 bg-slate-800 border border-slate-700 text-slate-200 rounded-lg px-3 py-2 text-sm font-mono placeholder-slate-600 focus:outline-none focus:border-emerald-600" required>
+          <button type="submit"
+                  class="px-4 py-2 bg-emerald-700 hover:bg-emerald-600 text-white text-sm font-semibold rounded-lg transition whitespace-nowrap">
+            Brug kode
+          </button>
+        </form>
       </div>
     </details>
-    {% endif %}
 
     {% endif %}{# end not cb_success #}