Register a Finch webhook endpoint and verify signatures with HMAC-SHA256

Steps

1. Create a webhook endpoint in the Finch Developer Dashboard; webhooks require a Starter, Pro, or Premier plan (not available on legacy Free/Build plans)
2. Store the one-time webhook secret shown at creation time
3. On receipt, extract the Finch-Event-Id, Finch-Timestamp, and Finch-Signature headers, and build the signed content string {webhook_id}.{webhook_timestamp}.{body}
4. Base64-decode the secret, compute an HMAC-SHA256 digest of the signed content, base64-encode it, and compare against each signature listed in Finch-Signature (space-delimited, to support secret rotation)
5. Reject the webhook if the timestamp is more than five minutes old, and respond 200 immediately, processing the payload asynchronously