Webhooks done right: verify signatures and deduplicate

BookMySpot POSTs each delivery event to your endpoint. Two rules:

1. Verify the X-Bookmyspot-Signature — HMAC-SHA256 of the raw body with your signing secret.
2. Deduplicate on event_id — a retry repeats it, so store what you have processed.

Return 2xx fast and do heavy work async, or slow handlers turn into duplicate events.