fix: reject unknown ecosystems instead of silently defaulting to pypi

tests/test_webhooks.py

@@ -112,8 +112,8 @@ def test_detect_ecosystem_npm():
 def test_detect_ecosystem_unknown():
     from guarddog_nexus.routes.webhooks import _detect_ecosystem
 
-    assert _detect_ecosystem({"format": "maven"}) == "pypi"  # unknown → default
-    assert _detect_ecosystem({}) == "pypi"  # default
+    assert _detect_ecosystem({"format": "maven"}) is None
+    assert _detect_ecosystem({}) is None
 
 
 # --- Go/npm webhook integration ---