Secure webhook replay and privileged API writes

[isavaima8-alt]

Summary

• Add merchant API-key issuance/rotation and revocation; persist only SHA-256 hashes and derive invoice ownership from the authenticated key.
• Persist owner-scoped webhook delivery history and add authenticated replay for failed deliveries, recording each replay and correlation ID.
• Sign webhook requests over timestamp.rawBody, include a Unix timestamp, and retain a body-only X-COMEBACKHERE-Legacy-Signature for one release to support receiver migration.
• Add shared admin auth and correlation-aware audit logging for privileged write routes.

Signature migration

Receivers should begin validating X-COMEBACKHERE-Timestamp and the HMAC of timestamp + "." + rawBody, rejecting timestamps outside a five-minute tolerance. During this release, the body-only digest remains available in X-COMEBACKHERE-Legacy-Signature; remove that fallback after receivers have migrated. Documentation examples are updated.

Admin-protected writes

• POST /compliance/allow
• POST /compliance/block
• POST /api/treasury/approve-settlement
• POST /api/treasury/execute-settlement
• POST /api/treasury/release-hold
• POST /api/treasury/escalate-hold
• POST /api/treasury/threshold
• POST /api/invoice/grace-window
• POST /invoices/:id/release-escrow

Missing admin credentials return 401; invalid credentials return 403. Both use the standard error envelope. Read-only routes, including settlement simulation, remain public.

Verification

Per request, no compilation or tests were run. git diff --check passed.

Closes #692
Closes #693
Closes #694
Closes #695

[drips-wave]

@isavaima8-alt Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits