fix(webhooks): forward Standard Webhooks headers from listen --forward-to

[jflayhart]

Stacked on #40 (bump-sdk-0.31). The implementation needs no new SDK, but the test verifies against client.webhooks.unwrap(), which only exists from 0.31.0. Merge #40 first and this retargets to main.

The problem

linq webhooks listen --forward-to signed forwarded events with only the legacy scheme — HMAC-SHA256 over {timestamp}.{body}, hex, in X-Webhook-Signature.

Production (webhook-service/internal/dispatcher/dispatcher.go) sends that too, but leads with Standard Webhooks:

req.Header.Set("webhook-id", webhookID)
req.Header.Set("webhook-timestamp", ...)
req.Header.Set("webhook-signature", standardSig)   // "v1," + base64
req.Header.Set("X-Webhook-Signature", legacySig)   // deprecated, still sent

So the local forwarder never emitted webhook-id, webhook-timestamp, or webhook-signature.

That breaks the documented development loop. A handler written against client.webhooks.unwrap() — the helper we point developers at — requires the Standard Webhooks headers. It therefore rejected everything the forwarder sent, while working correctly in production. The natural response to a handler that drops 100% of local traffic is to delete the verification, which is the opposite of what we want people shipping.

The change

The forwarder now emits both header sets, matching the dispatcher. The legacy pair stays so existing handlers keep working.

decodeSigningSecret is a faithful port of the dispatcher's, including the url-safe and raw-bytes fallbacks for legacy secrets. Worth a look during review: Go's base64 decoders reject invalid characters, while Node's silently drop them, so the charset is checked explicitly rather than relying on Buffer.from to fail.

Verification

7 new tests, 179 passing overall:

• a signature produced here is accepted by the SDK's unwrap()
• negative controls: tampered body rejected, wrong secret rejected
• decodeSigningSecret covers whsec_-prefixed, bare legacy, url-safe, and non-base64 secrets

🤖 Generated with Claude Code

https://claude.ai/code/session_01L3QhRZE6nKoGLGNhzUkmmF