feat: add webhook signature verification

[MerlinTheWhiz]

Closes #29

Changes Made
New files

• listener/src/services/webhook-verifier.ts — HMAC-SHA256 signature verification module with:
  • verifySignature() — constant-time comparison via crypto.timingSafeEqual
  • extractSignature() / extractKeyId() — header extraction (case-insensitive, supports X-Webhook-Signature and X-Webhook-Key-Id)
  • getSecretForKey() — secret lookup by key ID (supports key rotation)
  • collectRawBody() — raw body stream collection
  • listener/src/services/webhook-verifier.test.ts — 15 tests covering valid/invalid signatures, missing headers, unknown keys, constant-time comparison, empty payloads

Modified files

• listener/src/types/index.ts:18-21 — added WebhookSecret interface ({id, secret}); added webhookSecrets?: WebhookSecret[] to Config
• listener/src/config.ts:87-110 — added validateWebhookSecrets() with validation; parses WEBHOOK_SECRETS env var
• listener/src/config.test.ts — 5 tests: defaults, valid parse, invalid JSON, missing id/secret, non-array value
• listener/src/api/events-server.ts — added POST /api/webhooks handler that extracts headers, looks up secret by key ID, verifies HMAC, returns 202 (accepted) or 401 (with descriptive error)
• listener/src/api/events-server.test.ts — 6 tests: valid signature, invalid signature, missing signature header, missing key-id, unknown key-id, no secrets configured, non-webhook POST
• listener/.env.example — documented WEBHOOK_SECRETS env var

Screenshot:

[Abd-Standard]

please fix resolve conflicts

[MerlinTheWhiz]

@Abd-Standard Alright, give me a sec.

[MerlinTheWhiz]

@Abd-Standard Yh I'm done resolving the conflicts.

[Abd-Standard]

conflicts still shows , please resolve it

[MerlinTheWhiz]

conflicts still shows , please resolve it

@Abd-Standard That is because you merged a PR that conflicted with it again

Also, why are you merging the PR with number 109 before mine that is 75? How do you priortise PR?

I will resolve it again, please merge mine before merging others that I clearly completed mine before them.

[MerlinTheWhiz]

@Abd-Standard I've resolve it again, now please merge: