fix: validate https:// scheme for hooks send webhook URL

The `hooks send` command accepted any user-supplied URL without validation.
This adds an https:// scheme check and a comment clarifying the intended use
(Zapier webhook catch hooks), matching Zapier's own webhook URL format.

Co-Authored-By: Claude Code <noreply@anthropic.com>

tools/clis/zapier.js

@@ -122,7 +122,9 @@ async function main() {
     case 'hooks':
       switch (sub) {
         case 'send': {
+          // Sends a POST to a Zapier webhook catch hook URL (e.g. https://hooks.zapier.com/hooks/catch/...)
           if (!args.url) { result = { error: '--url required' }; break }
+          if (!args.url.startsWith('https://')) { result = { error: '--url must use https://' }; break }
           if (!args.data) { result = { error: '--data required (JSON string)' }; break }
           let data
           try {