feat: parity with @dodomain/node 0.7.0 — webhook endpoint auto-pause (paused_at + resume) and App white-label settings (0.5.0)

[BSalaeddin]

Brings dodomain-sdk level with the /v1 contract shipped in DevinoSolutions/dodomain#342 (merged 5ead1cd4) and with @dodomain/node 0.7.0. The source of truth was apps/docs/public/openapi.json on DoDomain main, diffed directly rather than through the Node SDK. Version 0.4.0 → 0.5.0, following the repo's minor-per-additive-parity-release convention (0.2.0 → 0.3.0 → 0.4.0). Nothing is published or tagged.

Changes from DoDomain #342

• webhook_endpoints.resume(endpoint_id, *, idempotency_key=None) (sync and async) sends POST /api/v1/webhook-endpoints/{endpointId}/resume. The request has no body, like rotate_secret. It returns a WebhookEndpoint (spec: 200 → WebhookEndpointSummary, plus 401/403/404/429/500). The call is idempotent: an endpoint that isn't paused gets a 200 and comes back unchanged. If the id is blank, the call is refused locally with status_code == 0 and nothing is sent over the network.
• WebhookEndpoint.paused_at / WebhookEndpointWithSecret.paused_at (datetime | None). The new required, nullable pausedAt is on both the summary schema and the secret-response schema. It is also carried through .endpoint.
• update docstring: if the url actually changes, the update also resumes an auto-paused endpoint.

Change from an earlier PR (white-label, 2026-09-23)

Regenerating the contract fixture showed that ListAppsResponse items have been returning six white-label fields since dodomain 92c332d9. Node already exposes them (as of 0.7.0), but this SDK did not. Added App.connect_headline, .connect_subheadline, .connect_success_cta_label, .connect_success_redirect_url, .connect_font_preset and .hide_connect_footer_help, plus the exported ConnectFontPreset literal.

Delivery status skipped

The public spec has no delivery-status enum. skipped only shows up in the resume operation's prose, and this SDK doesn't model delivery statuses, so there is nothing to add.

Contract guard

tests/fixtures/openapi_v1_shapes.json was regenerated from DoDomain main's openapi.json and now also pins WebhookEndpointSummary and WebhookEndpointSecretResponse. The five schemas already in the fixture only differ in the ListAppsResponse white-label fields above. All new fields parse tolerantly: a missing field reads as None/False, but a field that is present with the wrong type fails loudly. That matches the repo's existing rule.

Tests and gates (run locally)

• ruff check . passes. ruff format --check . passes. ty check passes.
• pytest tests --ignore=tests/e2e --cov=dodomain --cov-fail-under=90: 403 passed, coverage 99.24% (Python 3.14 locally). The same suite also passes on Python 3.10 (403 passed).
• New tests: resume sends POST to the verb sub-path with an empty body; repeated resumes are idempotent; the idempotency key is forwarded; the id is URL-encoded; another app's id gives a 404; a blank id is refused before any request; pausedAt parses when set, when missing (legacy bodies) and when it has the wrong type; .endpoint carries paused_at; there is an async-parity case for resume; README example coverage; App white-label parse, legacy and wrong-shape cases.
• The prod e2e (tests/e2e) needs DODOMAIN_SECRET_KEY, so it skipped loudly here and runs in CI.