feat: dual-key rotation for KYC webhooks

[Calebstack]

Overview

This PR adds a dual-key acceptance window for KYC vendor webhook signatures (current + next) with a hard expiry deadline, mounts the KYC webhook route, and emits kyc.webhook.verified_by_key per key slot.

Related Issue

Closes #676

Changes

🔐 Dual-key KYC webhook auth

• [ADD] src/routes/kycWebhooks.ts (+ tests)
  • POST /api/v1/webhooks/kyc protected by kycWebhookAuth().
• [MODIFY] src/middleware/webhookAuth.ts (+ tests)
  • Requires KYC_WEBHOOK_KEY_NEXT_EXPIRY whenever next key is set (fail-closed).
• [MODIFY] src/lib/webhookSignature.ts
  • Secondary key without parseable expiry treated as expired.
• [MODIFY] src/index.ts
  • Mounts KYC webhook router when primary secret is configured.

Verification Results

npx jest --runInBand --forceExit \
  src/routes/kycWebhooks.test.ts \
  src/middleware/webhookAuth.test.ts \
  src/lib/webhookSignature.test.ts \
  --coverage=false
✅ passed

Acceptance Criteria	Status
Dual-key current + next acceptance window	✅
KYC_WEBHOOK_KEY_NEXT + expiry env wiring	✅
Old/next-key acceptance expires on hard deadline	✅ Deadline elapsed rejects next-key deliveries
kyc.webhook.verified_by_key counter	✅ Labeled current / next

Timeline

• Calebstack committed