Webhook signature verification helper + replay protection

[Abuh-Bakar]

Implemented outgoing webhook signing using HMAC-SHA256(timestamp + "." + rawBody), with X-Vaultix-Signature and X-Vaultix-Timestamp headers. Endpoints can generate their own secret or accept one at creation; the authenticated rotation endpoint returns a new secret and keeps the previous one valid for 24 hours. List responses omit secrets.

Added SQLite and PostgreSQL migrations, service/controller tests, and receiver verification docs with Node and Python examples that check timestamp freshness and atomically reject replays. The backend README links to the guide.

Editor diagnostics and git diff --check pass. I couldn’t run backend Jest, lint, or TypeScript: backend dependencies were absent, and npm ci failed with a registry ECONNRESET.

Made changes.
Closes #834

[drips-wave]

@Abuh-Bakar Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[Cedarich]

@Abuh-Bakar