feat(webhooks): generate signing secret automatically on registration (#1211)

[lienhoatienphung-svg]

Summary

Automatically generates a 32-byte (64-hex-char) signing secret when POST /api/webhooks is called without a secret, returns the secret once in the 201 Created response body, rejects caller-supplied secrets shorter than 32 characters with 400 Bad Request, and ensures all subsequent webhook deliveries carry X-Callora-Signature.

Closes #1211

Key Changes

1. Webhook Registration (src/routes/webhooks.ts):
   • Rejects caller-provided secret values shorter than 32 characters with 400 Bad Request (INVALID_WEBHOOK_SECRET).
   • Calls generateWebhookSecret() (32 random bytes = 64 hex chars) when secret is omitted, persists it in WebhookStore, and returns secret once in the 201 response body while keeping GET /api/webhooks/:developerId free of secret fields.
2. Webhook Dispatcher (src/webhooks/webhook.dispatcher.ts):
   • Added resolveWebhookSigningSecret(config) to resolve config.secret_current ?? config.secret so subscriptions registered with secret_current always sign outbound payloads with X-Callora-Signature.
3. Documentation (docs/webhooks.md, WEBHOOK_SIGNATURE_VERIFICATION.md):
   • Updated registration and signature verification docs to reflect automatic secret generation, the 32-character minimum for caller-supplied secrets, and one-time secret display on 201 Created.

Verification

• Verified with npx jest src/routes/webhooks.test.ts src/webhooks/webhook.dispatcher.test.ts (all tests passed).

Payout Wallet (Base Mainnet USDC)

0x3806cd592a508d1992Ed007C2F53de251C2E7452