docs: subscriber-facing webhook integration and signature-verification guide

[Shadow-MMN]

Summary

Author a subscriber-facing webhook integration guide at
docs/webhook-integration-guide.md covering everything an external
integrator needs to receive, verify, and process Disciplr webhook
deliveries reliably.

Changes

• docs/webhook-integration-guide.md — New handbook with:

  • HMAC-SHA256 signature verification (Node.js + Python examples with
    constant-time comparison)
  • Delivery header reference (x-disciplr-signature, x-disciplr-event,
    x-disciplr-event-id, x-disciplr-delivery-timestamp)
  • Payload schema versioning (v1/v2) and content negotiation
  • All 7 event types documented
  • Idempotent consumer pattern using x-disciplr-event-id
  • Retry/backoff behaviour (3 attempts, 2x multiplier, ±25% jitter)
  • Dead-letter queue and replay instructions
  • Circuit breaker states and transitions
  • Test-ping endpoint walkthrough
  • Field masking and PII stripping
  • Secret rotation grace window
  • Troubleshooting table and quick-reference appendix

• src/tests/docs.webhookGuide.test.ts — 26 drift-guard tests that
  assert the doc matches the live implementation (signature headers,
  schema versions, event types, retry config, etc.)

closes #884

[drips-wave]

@Shadow-MMN Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[1nonlypiece]

subscriber signature-verification guide reads well, landing it