Improve Resend driver with API webhook registration and signature verification

[markvaneijk]

Summary

• Webhook registration via API: The Resend driver now registers webhooks via POST https://api.resend.com/webhooks (matching Postmark/Mailgun behavior) instead of telling users to do it manually. Checks for existing webhooks to avoid duplicates and outputs the signing secret for the user to save.
• Svix webhook signature verification: Implements HMAC-SHA256 signature verification using Resend's Svix-based webhook signatures (svix-id, svix-timestamp, svix-signature headers) with 5-minute timestamp tolerance. Gracefully falls back to accepting all webhooks if no signing secret is configured.
• Expanded data mapping: Added tags to data mapping for richer event data extraction.
• Null safety: Fixed potential error in getUuidFromPayload when headers are missing from the payload.

New config key

Users should add services.resend.webhook_signing_secret to their config after running the webhook registration command. The secret is returned by Resend's API on webhook creation.

Test plan

• All 12 Resend tests pass (6 existing webhook event tests + 6 new tests)
• New test: email.sent (accepted) event type webhook
• New test: webhook registration via API with Http::fake()
• New test: skip registration when webhook already exists
• New test: valid Svix signature verification
• New test: reject invalid Svix signature
• New test: reject expired Svix timestamp
• Full test suite passes

🤖 Generated with Claude Code