[backend] Add Webhook Signature Verification for All Outgoing Webhooks

[ExcelDsigN-tech]

[backend] Add Webhook Signature Verification for All Outgoing Webhooks

Description: Outgoing webhooks in backend/src/services/webhookService.ts lack signature verification. Downstream services cannot verify authenticity, enabling spoofing attacks.

Impact: Security hardening; downstream integration reliability; compliance for financial webhooks.

Suggested Fix:

1. Add HMAC-SHA256 signing with per-endpoint secrets
2. Include timestamp and nonce in signature payload
3. Document verification algorithm for consumers
4. Add signature header: X-DukaPay-Signature: sha256=...
5. Rotate signing keys quarterly

Points: 150
Type: enhancement

Definition of Done

• HMAC-SHA256 signing on all outgoing webhooks
• Timestamp and nonce in signature payload
• Consumer verification documentation
• Signature header standard format
• Key rotation automation
• Implementation complete following component patterns
• Code review passed
• Documentation updated if needed
• All necessary CI checks passed

---

📋 Before working on this issue, please read our Contributing Guidelines — it covers branching, commits, PR standards, testing, and style guides.

Join our Telegram community to connect with other contributors, ask questions, and stay updated:

💬 Telegram: https://t.me/+eRqhka27TVo0NzM8

All official decisions, reviews, and coordination happen right here on GitHub. The Telegram group is a space for informal discussion and peer support.

[iheanyiezumaukom-ai]

@iheanyiezumaukom-ai has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hello Maintainer I desire to work on this task..

ℹ️ Repo Maintainers: To accept this application, review their application or assign @iheanyiezumaukom-ai to this issue.

[Gentleslyl2006]

@Gentleslyl2006 has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hello maintainer
I have reviewed what needs to be fixed for this issue to be resolved and that's what I'm very good at. Can you assign me the issue?
I promise the best result after I'm done fixing the issue

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Gentleslyl2006 to this issue.