Docs/onboarding env webhooks

[Obiajulu-gif]

Summary

This PR improves the RemitLend backend onboarding and operational documentation so new contributors can understand the required environment setup, background jobs, webhook behavior, and production considerations more easily.

What changed

• Expanded the backend README to reflect the current API responsibilities, including loan indexing, webhook delivery, score reconciliation, default checking, cleanup jobs, and NFT metadata support.
• Updated the documented runtime requirements to align with the Dockerfile’s Node 22 runtime.
• Added a clear environment variable reference, separating mandatory startup variables from optional or feature-dependent configuration.
• Improved .env.example with grouped sections, clearer comments, required-variable notes, and the WEBHOOK_MAX_PAYLOAD_BYTES setting.
• Exported REQUIRED_ENV_VARS from src/config/env.ts so the required startup configuration is explicit and reusable.
• Documented the webhook HMAC flow using the x-remitlend-signature header.
• Extracted reusable webhook helpers for creating and verifying HMAC-SHA256 signatures with timing-safe comparison.
• Trimmed outdated placeholder README sections that no longer reflect the current backend architecture.

Why this matters

These changes make it easier for contributors and deployers to set up the backend correctly, avoid missing critical environment variables, understand how schedulers behave in production, and safely verify signed webhook payloads.

Testing

• Not run locally; this is primarily a documentation and configuration clarity update.

Closes #21

[ogazboiz]

solid docs pass. node version lines up with the dockerfile (node:22-alpine), every required env var in env.ts is now in both the readme table and .env.example, and the schedulers plus the x-remitlend-signature hmac flow are clearly documented. nice touch extracting createWebhookSignature/verifyWebhookSignature with a timing-safe compare, and the deletions only trim aspirational placeholder sections, nothing load-bearing. build, typecheck and the full test suite all pass.

one thing before merge: npx prettier --check . fails on README.md (the markdown tables need prettier's column padding) and it was clean on main, so run npm run format and recommit. once that is green this is good to go.

if you want to keep contributing, join us on Telegram: https://t.me/+DOylgFv1jyJlNzM0

[Obiajulu-gif]

@ogazboiz merge my code

[ogazboiz]

the content is solid and the webhook facts are right (outgoing signature header x-remitlend-signature, internal auth header x-api-key, env.ts exports REQUIRED_ENV_VARS, timing-safe compare on the signature helpers). two things before it can land:

1. it now conflicts with main (README.md is the only conflicting file). please rebase:
   git fetch origin && git checkout docs/onboarding-env-webhooks && git rebase origin/main
   (resolve README.md, then git rebase --continue and force-push)

2. prettier still fails on README.md (the one item from my last review). run npm run format (or npx prettier --write README.md) and recommit during the rebase.

once it's rebased clean and prettier passes i'll merge. thanks for your patience.

if you want to keep contributing, join us on Telegram: https://t.me/+DOylgFv1jyJlNzM0

[ogazboiz]

the rebase is done (no more README conflict, you're up to date with main) and the webhook facts check out (outgoing x-remitlend-signature, internal x-api-key). one last thing, same prettier item from before:

1. README.md fails prettier (the env-var markdown tables need prettier's column padding). run: npm run format (or npx prettier --write README.md) and recommit.

that's the only blocker left, fix it and i'll merge.

if you want to keep contributing, join us on Telegram: https://t.me/+DOylgFv1jyJlNzM0