docs: expand cli security and webhook refs

docs/cli/webhooks.md

@@ -22,4 +22,70 @@ openclaw webhooks gmail setup --account you@example.com
 openclaw webhooks gmail run
 ```
 
-See [Gmail Pub/Sub documentation](/automation/cron-jobs#gmail-pubsub-integration) for details.
+### `webhooks gmail setup`
+
+Configure Gmail watch, Pub/Sub, and OpenClaw webhook delivery.
+
+Required:
+
+- `--account <email>`
+
+Options:
+
+- `--project <id>`
+- `--topic <name>`
+- `--subscription <name>`
+- `--label <label>`
+- `--hook-url <url>`
+- `--hook-token <token>`
+- `--push-token <token>`
+- `--bind <host>`
+- `--port <port>`
+- `--path <path>`
+- `--include-body`
+- `--max-bytes <n>`
+- `--renew-minutes <n>`
+- `--tailscale <funnel|serve|off>`
+- `--tailscale-path <path>`
+- `--tailscale-target <target>`
+- `--push-endpoint <url>`
+- `--json`
+
+Examples:
+
+```bash
+openclaw webhooks gmail setup --account you@example.com
+openclaw webhooks gmail setup --account you@example.com --project my-gcp-project --json
+openclaw webhooks gmail setup --account you@example.com --hook-url https://gateway.example.com/hooks/gmail
+```
+
+### `webhooks gmail run`
+
+Run `gog watch serve` plus the watch auto-renew loop.
+
+Options:
+
+- `--account <email>`
+- `--topic <topic>`
+- `--subscription <name>`
+- `--label <label>`
+- `--hook-url <url>`
+- `--hook-token <token>`
+- `--push-token <token>`
+- `--bind <host>`
+- `--port <port>`
+- `--path <path>`
+- `--include-body`
+- `--max-bytes <n>`
+- `--renew-minutes <n>`
+- `--tailscale <funnel|serve|off>`
+- `--tailscale-path <path>`
+- `--tailscale-target <target>`
+
+Example:
+
+```bash
+openclaw webhooks gmail run --account you@example.com
+```
+
+See [Gmail Pub/Sub documentation](/automation/cron-jobs#gmail-pubsub-integration) for the end-to-end setup flow and operational details.