Feat/webhook handling

[Petah1]

Summary

Implements `POST /webhooks/:provider` with per-provider HMAC verification, idempotency, and async job enqueueing.

Providers

• `github` — HMAC-SHA256 via `X-Hub-Signature-256`, dedup via `X-GitHub-Delivery`
• `stripe` — Stripe-Signature `t=,v1=` scheme with timestamp tolerance
• `generic` — HMAC-SHA256 with `X-Webhook-Timestamp` + `X-Webhook-Id`

Key features

• Constant-time signature comparison (`timingSafeEqual`) on all providers
• Timestamp validation rejects replays outside the 300s tolerance window
• Idempotency dedup — duplicates return `200 {status: duplicate}` without re-enqueueing
• Zero-downtime secret rotation: `secrets` is an array, list old + new during rollover
• BullMQ-compatible in-memory queue (swap for real BullMQ + Redis when available)
• Verification failures log provider + reason only — no secrets or bodies exposed
• Optional per-provider IP allowlisting
• `GET /webhooks/queue/stats` for observability
• 16 tests covering valid requests, bad signatures, replay attacks, duplicates, IP blocking, rotation

Closes #45

[drips-wave]

@Petah1 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits