Fail-closed pattern for temporarily unauthenticated webhooks
When a provider cannot sign callbacks, model the exception as an explicit server-side mode rather than inferring it from a missing secret. Default to authenticated mode, reject unknown values before reading or persisting the body, and let unauthenticated mode bypass only authenti…