Webhook 签名验证

Header

X-Site-Id: YOUR_SITE_ID
X-Event-Id: evt_...
X-Timestamp: 1787150000
X-Signature: <64 lowercase hex chars>

验签原文

timestamp + "\n" + event_id + "\n" + raw_webhook_body

expected = hex(HMAC-SHA256(API_SECRET, canonical))

使用常量时间比较函数验证签名，并以 Event ID 做幂等处理。