Signed (HMAC) outbound event webhooks to customers #52

Background

SendLit only receives webhooks (ESP feedback in delivery-feedback/). It never sends event webhooks to customers, so there's nothing signed.

Why it matters: embedding platforms need delivered, bounced, complained, opened, clicked and unsubscribed events pushed to their own systems to keep suppression and status in sync. Industry practice (Stripe, Postmark, Svix) is HMAC-SHA256 signatures with a timestamp, so receivers can verify the origin and reject replays.

Proposed fix

• Add per-team webhook endpoints with a generated secret, a choice of event types, retries with backoff and a delivery log.
• Sign each delivery with X-SendLit-Signature: t=<ts>,v1=<hmac(ts.body)>.

Acceptance criteria

• A team can register an endpoint and receive signed events.
• The documented verification snippet validates the signature and rejects stale timestamps.
• Failed deliveries retry and show in the log.
• Secrets can be rotated.