all: pass errors to panic, not strings

GraphQL's recovery middleware can't handle strings so it just logs a
very not useful <nil>

webhooks: Add middleware