Inbound webhook from incident.io

Dedicated ingest endpoint for incident.io webhooks. Streams the exact provider-signed bytes under a hard 1 MiB cap before strictly decoding UTF-8. Validates the Svix `webhook-id`, `webhook-timestamp`, and `webhook-signature` headers, including a five-minute replay window, and routes only when exactly one connected per-org encrypted signing secret matches. Handles `incident.created`, `incident.updated`, and `incident.resolved` events. Unknown event types return `{ ok: true, skipped: true }`. Missing, stale, malformed, duplicate, undecryptable, or over-cap candidate state fails closed with 401. `WEBHOOK_SECRET_INCIDENT_IO` is a bounded legacy fallback for exactly one connected env-only row and is never an alternate key for connected per-org rows.

curl -X POST "https://example.com/api/webhooks/ingest/incident-io" \  -H "webhook-id: string" \  -H "webhook-timestamp: string" \  -H "webhook-signature: string" \  -H "Content-Type: application/json" \  -d '{    "event_type": "incident.created",    "data": {}  }'

{
  "ok": true,
  "event_type": "string",
  "created": true,
  "updated": true,
  "resolved": true,
  "incidentId": "string"
}

{
  "error": "Session not found"
}

{
  "error": "Session not found"
}

{
  "error": "Session not found"
}

{
  "error": "Session not found"
}