Mock webhook receiver

Stands in for the system on the other end, like a CRM or a help desk. It checks the HMAC signature and stores each delivery once per idempotency key, so a retried send never shows up twice.