WebhookPix is the bank's settlement callback: it marks a charge RECEBIDO once the payer
pays. The authorization added in 1.2.0 placed it behind BackOfficeAccess, and Banco
Inter's server has no backoffice session, so every callback was answered with 401 and a
charge stayed pending after it had actually been paid.

It cannot simply be opened either — it marks money as received. It is now gated on
BancoInter:WebhookSecret, compared in fixed time, and refuses everything while that
secret is unset rather than defaulting to open.

The dashboard also reaches the plugin for the first time, and states plainly whether it
is pointed at sandbox or production.