[BE-96] Verify inbound webhook signatures and make handlers replay-safe

[yusuftomilola]

Overview

Payment webhooks drive subscription and invoice state. An unverified webhook endpoint lets anyone forge a "payment succeeded" event; an unguarded one can be replayed to double-credit an account.

Tasks

• Verify the provider's HMAC signature on every inbound webhook before parsing or acting on the body.
• Ensure the raw request body is available for signature computation (Nest's JSON parser otherwise mutates it — configure a raw-body route).
• Reject events whose timestamp is outside a tolerance window.
• Deduplicate by provider event ID so replays are no-ops.
• Return 2xx quickly and process asynchronously via Bull; never let slow handling cause provider retries.
• Log every rejected webhook with the reason.

Acceptance Criteria

• A request with an invalid signature returns 401 and changes no state.
• Delivering the same valid event twice credits the account once.
• Signature verification is covered by tests using a known-good fixture.

Notes for Contributors

Comment below to be assigned.