Add typed webhook verification utilities for Lily event consumers

[David-patrick-chuks]

Summary

Provide official SDK support for verifying webhook signatures and parsing trusted event payloads.

Why this matters

If Lily emits backend events, service integrators need a secure and convenient way to verify authenticity before processing them.

Scope

• Define webhook verification API shape.
• Support signature verification with clear input and output types.
• Add typed event payload models if backend event contracts are stable enough.
• Document secure usage patterns.

Acceptance Criteria

• Webhook verification utility is available from the SDK.
• Verification result is typed and safe to consume.
• Tests cover valid and invalid signature cases.
• Documentation explains expected request handling flow.

Dependencies

• Depends on Align core domain models with Lily backend response envelopes #1
• Depends on Implement pluggable authentication providers for API keys and token refresh #4