Fail-closed pattern for temporarily unauthenticated webhooks

When a provider cannot sign callbacks, model the exception as an explicit server-side mode rather than inferring it from a missing secret. Default to authenticated mode, reject unknown values before reading or persisting the body, and let unauthenticated mode bypass only authentication before rejoining the same size-limit, receipt, schema-validation, and projection pipeline. Keep downstream business side effects disabled during observation and retain the secret for immediate rollback.