fix: require Sendblue webhook secret

[danielz1z]

Summary

• require incoming Sendblue webhooks to include the configured signing secret
• accept Sendblue's documented sb-signing-secret header
• add parser regression coverage for missing, invalid, and valid signing secrets

Test Plan

• npm exec --yes bun@1.3.12 -- test apps/api/src/__tests__/sendblue.test.ts
• npm exec --yes bun@1.3.12 -- run test
• npm exec --yes bun@1.3.12 -- run lint
• npm exec --yes bun@1.3.12 -- run typecheck
• ./node_modules/.bin/turbo build --filter=@caltext/api

[vercel]

@danielz1z is attempting to deploy a commit to the Midday Labs AB Team on Vercel.

A member of the Team first needs to authorize it.

[danielz1z]

Thanks for the project. I kept this PR narrow: it only aligns the incoming webhook parser with Sendblue's documented signing-secret header and rejects unsigned webhook requests.\n\nI verified locally with Bun 1.3.12: test, lint, typecheck, and the filtered API build all pass. GitHub Actions is currently waiting for maintainer approval on the forked PR, and the Vercel preview checks show authorization required.