Webhook：实现与弹性
入站提供程序回调通过对原始请求体和时间戳窗口进行 HMAC 认证，支持密钥轮换，拒绝未签名的流量，并且在验证前不进行 JSON 解析。
Signed outbound webhooks with HMAC over the raw body, a stable delivery identity, bounded retries into a dead-letter, clock-skew tolerant timestamps, and no secret material in callback URLs.