Add webhook signature verification

[teesofttech]

Summary

Add webhook event signature verification support.

Docs: https://developers.termii.com/events-and-reports
Parent split from: #42

Scope

• Add a helper for verifying the X-Termii-Signature header.
• Use HMAC SHA512 over the raw event payload with the Termii secret key.
• Preserve the existing webhook event model support.

Acceptance criteria

• Verification API accepts raw payload, signature header, and secret key.
• Comparison is time-constant where practical.
• Tests cover valid signatures, invalid signatures, missing signatures, and altered payloads.
• README/docs explain how to verify before deserializing or trusting webhook payloads.

[teesofttech]

Implemented by #49.