feat: add webhook signature verification and fix security issues

Security Improvements:
- Add HMAC-SHA256 signature verification for MailGun webhooks
- Remove hardcoded signing key fallback, require env variable
- Add proper payload structure validation before processing

API Changes:
- New types: MailgunWebhookPayload, MailgunWebhookPayloadSignature
- New type guard: isMailgunWebhookPayload()
- Returns 401 for invalid signatures, 400 for malformed payloads

Configuration:
- Add MAILGUN_WEBHOOK_SIGNING_KEY to both docker-compose files
- Service fails fast on startup if signing key not configured

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

docker-stack/docker-compose-standalone.yaml

@@ -88,6 +88,7 @@ services:
       PROMETHEUS_APP_LABEL: mailgun-webhook-service
       PROMETHEUS_HISTOGRAM_BUCKETS: 0.1,0.5,1,5,10
       DEBUG: server:*,app:*
+      MAILGUN_WEBHOOK_SIGNING_KEY: ${MAILGUN_WEBHOOK_SIGNING_KEY}
     container_name: evidencija-rezija__mailgun-webhook
     restart: unless-stopped
     labels: