Webhook handlers are not idempotent and can double-process events

[boluwacodes]

Incoming webhook events are processed directly without checking whether that event ID has already been handled, so a redelivery from the upstream provider can apply the same state change twice.

Fix: Persist processed event IDs and short-circuit duplicate deliveries.