[wcislom]

Summary

Ingress now accepts only webhooks with a valid TT-Signature v2 header and answers 401 to everything else,
before the body is parsed or stored. This closes the known limitation "Ingress accepts unsigned webhooks".

Changes

• Verification is an endpoint filter in Infrastructure.Teamtailor (TeamtailorSignatureFilter), attached to the
  webhook route with RequireTeamtailorSignature(). The webhook parser is unchanged: it only parses.
  The filter reads the raw body with EnableBuffering() and rewinds it, because the endpoint hashes the same bytes into the EventId.
• Public surface of Infrastructure.Teamtailor gains RequireTeamtailorSignature, so the project now references
  the ASP.NET Core shared framework (docs/architecture.md updated). Two package references that the framework
  already provides were removed (NU1510).
• Configuration: Teamtailor:WebhookSignatureKey (fake value in appsettings.Development.json, real one in
  user-secrets or the environment) and Teamtailor:WebhookSignatureTolerance (00:05:00), both validated on start.
• FakeTeamtailor signs every webhook with its own implementation (Teamtailor/WebhookSignature), never shared
  with src/, so a misreading of the docs cannot make both sides agree. Integration tests that call Ingress
  directly sign with the same class.
• Scenario I3 (docs/acceptance-scenarios.md): a webhook signed with another key gets 401 and leaves no outbox row.
  The scenario intro now allows a rule in .claude/rules/ as what a scenario illustrates.