fix: add inbound webhook signature headers

[Lubrsy706]

Closes #130.

Summary

• add a shared HMAC helper for webhook payload signatures
• include X-Inbound-Signature and the backward-compatible X-Webhook-Signature on inbound webhook deliveries
• include the same signature headers for webhook test sends and document them in the API reference

Testing

• git diff --check
• Not run: Bun-based test suite, because Bun is not installed in my environment

[vercel]

@Lubrsy706 is attempting to deploy a commit to the inbound Team on Vercel.

A member of the Team first needs to authorize it.