feat: add webhook signature helper

[Justinabox]

Summary

• add a pure webhook_signature(secret, timestamp, payload) HMAC-SHA256 helper
• define the canonical signed byte sequence as timestamp.encode("ascii") + b"." + payload
• add fixed-vector coverage for printable and binary raw payload bytes, including a UTF-8 secret

Verification

• git diff --check
• PYTHONPATH=. uv run --no-project --with pytest --with pytest-asyncio --with pytest-aiohttp --with pyserial-asyncio --with aiosqlite pytest tests/test_webhooks.py -q → 2 passed
• PYTHONPATH=. uv run --no-project --with pytest --with pytest-asyncio --with pytest-aiohttp --with pyserial-asyncio --with aiosqlite pytest tests/ -q → 1001 passed in 7.17s

Scope and risk

This is intentionally only the deterministic signing foundation for #21. It does not alter the legacy webhook dispatcher, add callback headers, configure signing secrets, send network requests, or add retry/diagnostic behavior. Follow-up integration must preserve raw serialized request bytes and keep secrets/payloads out of logs.

Closes none; partial foundation for #21.

[Justinabox]

Release-lane classification: needs-human.

This introduces a webhook-signature cryptographic contract. The signed-byte framing and compatibility/rollout policy need explicit security/product approval before this foundation is landed. No merge action taken in this lane.

[Justinabox]

Release-lane classification: needs human decision.

This changes a security-sensitive or externally exposed policy surface. It requires Korgo's explicit product/security decision and a focused security review before an autonomous merge; local test success alone is not authorization to land it.

[Justinabox]

Release classification: needs-human.

This change affects an externally visible security/default-exposure policy. It should not be merged autonomously without Korgo’s explicit decision on the intended compatibility and threat-model behavior. Please retain as a draft pending that decision; any follow-up must be rebased on current main and revalidated with the prescribed full suite.

[Justinabox]

Release review: needs-human. Webhook signature canonicalization, encoding, and signature format define an external protocol contract. Korgo must approve that policy before merge.

[Justinabox]

Release classification: needs-human decision.

Webhook URL/signature work is an externally exposed security boundary. The scheduled lane requires an explicit product/security decision on admission, DNS/redirect handling, and signature framing/rotation policy before landing this work.