Webhook verification

1. Read the untouched request bytes.
2. Pass the bytes and original headers to verifyDomain0Webhook().
3. Let the verifier validate schema version, timestamp, key ID, and signature.
4. Insert eventId and apply your mutation in one transaction.
5. Return 2xx for a duplicate already committed event.

Keep a keyring during rotation so in-flight deliveries signed by the previous key remain verifiable. Do not log signatures, signing secrets, or sensitive event attributes.