feat(webhooks): export verifyWebhookSignature and WebhookVerificationError from index (Fixes #617)

[s6pa1rta3n-lab]

Fixes #617
/claim #617

Description

This PR exposes verifyWebhookSignature and WebhookVerificationError as first-class standalone exports from src/webhooks/verify.ts and src/index.ts, allowing consumers to directly verify incoming webhook payloads without manual copying of cryptographic verification logic.

Summary of Changes

• src/webhooks/verify.ts:
  • Implemented standalone verifyWebhookSignature(payload: string, signature: string, secret: string): boolean.
  • Employs HMAC-SHA256 calculation (crypto.createHmac('sha256', secret).update(payload).digest('hex')) and constant-time comparison via crypto.timingSafeEqual to prevent timing side-channel attacks.
  • Safely handles malformed hex signatures, odd length strings, mismatched buffer lengths, and non-string inputs returning false without throwing.
  • Implemented and exported WebhookVerificationError class (extending StellarSplitError) with static .verify(...) and .assert(...) helper methods, as well as assertWebhookSignature standalone helper.
• src/errors.ts: Added WebhookVerificationError to SDK typed errors.
• src/index.ts: Exported verifyWebhookSignature, WebhookVerificationError, assertWebhookSignature, WebhookAgent, and WEBHOOK_SIGNATURE_HEADER.
• test/webhookVerify.test.ts: Comprehensive unit test suite covering valid HMAC signatures, case-insensitivity, invalid secrets, tampered payloads, length mismatches, odd-length signatures, malformed hex, non-string arguments, and WebhookVerificationError assertions.

Acceptance Criteria Checklist

• verifyWebhookSignature(payload: string, signature: string, secret: string): boolean exported from src/webhooks/verify.ts
• Uses HMAC-SHA256: crypto.createHmac('sha256', secret).update(payload).digest('hex') and compares with signature using a timing-safe comparison (crypto.timingSafeEqual)
• Returns false (never throws) when signature is malformed or lengths differ
• WebhookVerificationError class exported for consumers who prefer throwing — wraps verifyWebhookSignature and throws if it returns false
• Both exported from src/index.ts
• Unit tests: valid signature returns true, wrong secret returns false, tampered payload returns false, mismatched length returns false without throwing

Payout Routing

• EVM (Base/Arbitrum/Polygon/ETH): 0xF46C9F6d70C50BF81ef3588AB523a90a594a2F89
• Stellar: GCL6OXAMLD75BMTINA6EMRUDWK5THQUSHMYNLSNBCJAPZJHNYJTUNIBC