feat(webhooks): export verifyWebhookSignature and WebhookVerificationError from index (#617)

[s6pa1rta3n-lab]

Resolves #617

Description

Exposes verifyWebhookSignature as a standalone synchronous verification function and WebhookVerificationError class from src/webhooks/verify.ts and src/index.ts.

Checklist & Acceptance Criteria

• verifyWebhookSignature(payload: string, signature: string, secret: string): boolean exported from src/webhooks/verify.ts
• Uses HMAC-SHA256: crypto.createHmac('sha256', secret).update(payload).digest('hex') and compares with signature using timing-safe comparison (crypto.timingSafeEqual)
• Returns false (never throws) when signature is malformed, odd length, non-hex, or lengths differ
• WebhookVerificationError class exported for consumers who prefer throwing — wraps verifyWebhookSignature (.assert(), .verify(), and assertWebhookSignature)
• Both verifyWebhookSignature and WebhookVerificationError (plus assertWebhookSignature) exported from src/index.ts
• Unit tests added covering valid signatures, wrong secret, tampered payload, mismatched length, odd length, malformed hex, uppercase hex, and error throwing behaviors without mocking assertions.

Closes #617
/claim #617

Payout Routing

• EVM (Base/Arbitrum/Polygon/ETH): 0xF46C9F6d70C50BF81ef3588AB523a90a594a2F89
• Stellar: GCL6OXAMLD75BMTINA6EMRUDWK5THQUSHMYNLSNBCJAPZJHNYJTUNIBC