[#544] Add signed webhook delivery with retries and DLQ

[Jagadeeshftw]

Summary

Adds a secure, observable webhook delivery pipeline for subscribed events.

What changed

• Signs each JSON delivery with HMAC-SHA256 over timestamp.rawBody.
• Adds timestamp, stable delivery ID, and signature headers for subscriber verification and deduplication.
• Retries transient HTTP responses (408, 425, 429, 5xx) and transport failures with bounded exponential backoff and jitter.
• Enforces a 256 KiB UTF-8 payload limit and exposes stable typed delivery error codes.
• Dispatches matching and wildcard events independently to registered subscribers.
• Stores exhausted deliveries in the in-process dead-letter store and provides list, lookup, and replay APIs.
• Generates webhook secrets at registration while keeping them out of list/get/patch responses.
• Adds focused unit and integration coverage for signatures, tampering, retries, exhaustion, replay, idempotency, routing, and payload bounds.
• Documents the signing contract, retry policy, payload/error behavior, DLQ operations, and operational guidance.

Verification

• npm run build
• npm run lint
• node --test dist/webhookDelivery.test.js dist/apikeys-webhooks.test.js (25 passing tests)
• npm test was also started; this repository-wide glob did not exit in the local environment after emitting passing output, so it was stopped.

Closes #544