Drafted with Claude, reviewed manually.

Most public webhook providers sign deliveries with HMAC-SHA256 over
the raw body and ship the signature in a provider-specific header:

Dagu's bearer-token endpoint auth proves the URL wasn't tampered
with, not that the body came from the configured source. Layering
HMAC verification gives meaningful defense-in-depth: a leaked Dagu
webhook token and a leaked HMAC secret are independent surfaces.

Possible shape: per-DAG webhook config gains an optional
hmac_secret (and signature scheme: header name + prefix +
algorithm). Endpoint rejects mismatched signatures before enqueuing
the DAG run.

Header passthrough (covered separately in #2037) lets the
DAG itself verify; native verification at the endpoint would handle
the common case without DAG-side glue and avoids coupling each DAG
to a provider's signing scheme.

Discussion context:
https://discord.com/channels/1095289480774172772/1409891877288939560/1497580577325453373

Happy to put up a PR once the shape is settled.