Webhook HMAC signature computed with wrong encoding

[dreamgeneX]

Summary

HMAC computed over base64-encoded body instead of raw bytes.

Scope

• Backend repo: stargate-backend
• Type: bug
• Area: Bug

Acceptance Criteria

• The behavior is implemented or fixed in the backend service, worker, reconciler, migration, docs, or tests as appropriate.
• Relevant automated coverage is added or updated.
• npm run typecheck, npm test, and any relevant e2e/Cargo checks pass.

Batch source: PDF; item 19 of 150.

[sravan27]

Opened a focused PR for this: #216.

What it does:

• removes the parsed-object reserialization path from verification
• verifies only exact raw string | Buffer bodies
• updates the webhook docs to make the raw-body contract explicit
• adds regressions for raw JSON strings, Buffers, reconstructed objects, and rotation overlap verification

Validated locally with focused Jest, typecheck, build, and diff-check.

If useful, I can also take the next bounded webhook reliability slice: $2,000 / 48h for timestamp + delivery-id replay enforcement with receiver examples, or $5,000 / 5 days for the broader webhook/payment assurance pass across signature rotation, retry semantics, event idempotency, and merchant-facing runbooks. No need to change scope here unless you want that paid sprint.