fix: verify Circle webhook signatures

[skyc1e]

Adds Circle webhook signature verification before processing inbound notifications.

• requires X-Circle-Signature and X-Circle-Key-Id on webhook POST requests
• fetches and caches Circle's public key for the provided key id
• verifies the raw request body before parsing or updating balances
• documents the optional CIRCLE_WEBHOOK_SECRET Bearer guard as an extra layer

Circle documents these signature headers in the webhook setup guide: https://developers.circle.com/wallets/webhook-notifications#4-verify-digital-signature

Checked:

• npm run lint
• npm run build with local dummy env values required by the current env schema
• git diff --check upstream/master..HEAD