Please address the comments from this code review:

## Individual Comments

### Comment 1
<location path="src/api/integrations/event/webhook/webhook.schema.ts" line_range="36" />
<code_context>
-        url: { type: 'string' },
+        url: {
+          type: 'string',
+          pattern: WEBHOOK_HTTP_URL_PATTERN,
+          description: 'The "url" must be an http or https URL without whitespace',
+        },
</code_context>
<issue_to_address>
**Instance webhooks are skipped**

When an instance is created with a nested webhook URL using a non-HTTP(S) scheme, `instanceSchema` does not validate nested `webhook.url`, so `EventManager.setInstance` forwards it to `WebhookController.set`, which persists it; `emit` then skips the non-HTTP(S) destination and the instance sends no webhook events.

Validate the nested URL in `instanceSchema` or apply `webhookSchema` during instance creation before calling `EventManager.setInstance`.
</issue_to_address>

### Comment 2
<location path="src/api/integrations/event/webhook/webhook.url.ts" line_range="2" />
<code_context>
+/** http(s) URL with no whitespace. Anchored so the schema rejects any other scheme or padding. */
+export const WEBHOOK_HTTP_URL_PATTERN = '^https?:\\/\\/\\S+$';
+
+/** Value stored for a webhook URL. Callers persist this, not the raw input. */
</code_context>
<issue_to_address>
**Malformed destinations pass validation**

When a caller submits a non-whitespace value with an HTTP(S) prefix that is not a valid URL, `WEBHOOK_HTTP_URL_PATTERN` checks only the scheme and whitespace, so malformed destinations pass validation and are persisted; Axios then fails to deliver the webhook event.

Validate that the entire value is a valid HTTP(S) URL, including a host, rather than relying on a scheme-and-whitespace pattern.

Also at `src/api/integrations/event/webhook/webhook.schema.ts:36`.
</issue_to_address>

### Comment 3
<location path="src/api/integrations/event/webhook/webhook.url.ts" line_range="2" />
<code_context>
+/** http(s) URL with no whitespace. Anchored so the schema rejects any other scheme or padding. */
+export const WEBHOOK_HTTP_URL_PATTERN = '^https?:\\/\\/\\S+$';
+
+/** Value stored for a webhook URL. Callers persist this, not the raw input. */
</code_context>
<issue_to_address>
**Valid uppercase schemes are rejected**

When a caller supplies a valid URL with an uppercase or mixed-case HTTP(S) scheme, `WEBHOOK_HTTP_URL_PATTERN` is case-sensitive, so validation rejects the destination and callers cannot save the webhook configuration.

Make the scheme check case-insensitive.

Also at `src/api/integrations/event/webhook/webhook.schema.ts:36`.
</issue_to_address>

### Comment 4
<location path="src/api/integrations/event/webhook/webhook.url.ts" line_range="2" />
<code_context>
+/** http(s) URL with no whitespace. Anchored so the schema rejects any other scheme or padding. */
+export const WEBHOOK_HTTP_URL_PATTERN = '^https?:\\/\\/\\S+$';
+
+/** Value stored for a webhook URL. Callers persist this, not the raw input. */
</code_context>
<issue_to_address>
**Trailing newlines pass validation**

When a submitted URL ends in a line terminator, javaScript’s `$` matches before a final line terminator, so `WEBHOOK_HTTP_URL_PATTERN` accepts the value and schema validation does not reject the trailing whitespace.

Change the pattern to require the actual end of the input after the URL.

Also at `src/api/integrations/event/webhook/webhook.schema.ts:36`.
</issue_to_address>

### Comment 5
<location path="src/api/integrations/event/webhook/webhook.url.test.ts" line_range="23-24" />
<code_context>
+assert.equal(httpsResult.valid, true, 'normal https:// URL must be accepted');
+console.log('normal https:// URL accepted');
+
+const persisted = persistedWebhookUrl('  https://example.com/hook  ');
+assert.equal(persisted, 'https://example.com/hook');
+console.log('persisted value is trimmed', persisted);
</code_context>
<issue_to_address>
**Controller stores padded URLs**

When a controller persistence call site stops using the helper, if `WebhookController.set` passes `data.webhook.url` directly to Prisma instead of calling `persistedWebhookUrl`, the test still passes: `webhook.url.test.ts` lines 23–24 invoke and assert only the helper, not the value persisted by the controller.

Exercise `WebhookController.set` and assert that the value passed to Prisma is trimmed.
</issue_to_address>