feat(webhooks): export standalone verifyWebhookSignature with timingSafeEqual and WebhookVerificationError (#617)

[s6pa1rta3n-lab]

Summary of Changes

• Exposes verifyWebhookSignature as a standalone utility from src/webhooks/verify.ts and re-exports it from src/index.ts.
• Computes HMAC-SHA256 digest over the raw payload and performs constant-time comparison via crypto.timingSafeEqual to prevent timing attacks.
• Gracefully handles malformed hex signatures, mismatched lengths, and non-string inputs by returning false without throwing.
• Introduces and exports WebhookVerificationError and assertWebhookSignature for consumers requiring throwing assertion flows.
• Adds comprehensive unit tests in test/webhooks/verify.test.ts covering valid signatures, invalid keys, tampered payloads, odd-length signatures, and export verification.

Closes #617
/claim #617

Payout Routing

• EVM (Base/Arbitrum/Polygon/ETH): 0xF46C9F6d70C50BF81ef3588AB523a90a594a2F89
• Stellar: GCL6OXAMLD75BMTINA6EMRUDWK5THQUSHMYNLSNBCJAPZJHNYJTUNIBC