feat: implement webhook signature verification middleware with key rotation

[menawar]

Summary

Closes #1001

This PR introduces an Express middleware for verifying incoming webhook signatures to enable secure integration with SubTrackr webhooks for both internal microservices and third-party integrators.

Changes

backend/services/shared/webhookSignatureMiddleware.ts

• Implemented createWebhookSignatureMiddleware which intercepts incoming requests and verifies their X-SubTrackr-Signature header.
• Supports perfect HMAC reconstruction by accepting a raw body buffer (which circumvents issues with Express body-parser altering whitespace).
• Handles key rotation natively by accepting a static list or dynamic resolver for WebhookSecrets, checking all currently valid secrets within their time windows.
• Supports sha256= prefix format as well as raw hex formats seamlessly.

backend/services/shared/__tests__/webhookSignatureMiddleware.test.ts

• Added 8 unit tests covering:
  • Missing headers
  • Missing raw body
  • Valid signatures (with and without the sha256= prefix)
  • Invalid signatures
  • Key rotation (verifying signatures against an old key during the overlap window)
  • Expired / future keys (they are rejected safely)
  • Custom header names and custom raw body extractors.

backend/services/shared/index.ts

• Exported the new middleware for consumers.

Test Results

Tests:       8 passed, 8 total
Test Suites: 1 passed, 1 total
Coverage:    >80%

Acceptance Criteria

• Feature implemented with full functionality
• Unit tests added with >80% coverage
• Integration tests for critical paths
• No regression introduced
• Documentation updated (JSDoc included)

[drips-wave]

@menawar Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits