test(api): cover webhook signature verification

[pengyuayn]

What

Adds unit coverage for verifyWebhook HMAC verification and replay protection paths.

Why

Issue #407 asks for coverage around timing-safe HMAC comparison and signature rejection paths. These tests lock down valid signatures, wrong-secret signatures, flipped-byte signatures, missing/empty signature headers, raw body requirements, pending-secret rotation, and duplicate webhook IDs.

How

• Mocks the DB app_config secret lookup, Redis replay guard, and logger.
• Uses signWebhookPayload to generate valid request signatures.
• Spies on crypto.timingSafeEqual and crypto.createHmac to assert timing-safe comparison is used and malformed requests return before HMAC work.
• Keeps the test fully isolated from Postgres, Redis, and Express server startup.

Test plan

• ./node_modules/.bin/vitest run apps/api/src/middleware/__tests__/verify-webhook.test.ts
• ./node_modules/.bin/prettier --check apps/api/src/middleware/__tests__/verify-webhook.test.ts
• ./node_modules/.bin/tsc -p apps/api/tsconfig.json --noEmit currently stops on an existing unrelated syntax error in apps/api/src/routes/leaderboard.ts.

Closes #407