[Payments] Add Webhook Signature Verification to Delivery Confirmation

[ScriptedBro]

Migrated from DelegoLabs/Delego#445.
This issue belongs to the backend repository after the monorepo split.

---

Type
Task

Area
Backend / Payments

Complexity
Moderate

Problem
apps/backend/payments/src/routes.ts:232 accepts delivery confirmation webhooks without any signature verification. Anyone can trigger escrow release by sending a forged webhook.

Implementation Scope

• apps/backend/payments/src/routes.ts

Functions to Implement

1. Verify HMAC-SHA256 signature in X-Webhook-Signature header against a shared secret.
2. Reject requests with invalid or missing signatures.
3. Make webhook secret configurable via env var.

Tests

• Unit test: valid signature passes.
• Unit test: invalid signature returns 401.
• Unit test: missing signature returns 401.

Acceptance Criteria

• Only webhooks with valid HMAC signatures are processed.
• Signature verification uses constant-time comparison.

Verification

• pnpm test passes.
• pnpm build completes.