Inbound webhook from incident.io

Dedicated ingest endpoint for incident.io webhooks. Streams the exact provider-signed bytes under a hard 1 MiB cap before strictly decoding UTF-8. Validates the Svix `webhook-id`, `webhook-timestamp`, and `webhook-signature` headers, including a five-minute replay window, and routes only when exactly one connected per-org encrypted signing secret matches. Handles `incident.created`, `incident.updated`, and `incident.resolved` events. Unknown event types return `{ ok: true, skipped: true }`. Missing, stale, malformed, duplicate, undecryptable, or over-cap candidate state fails closed with 401. `WEBHOOK_SECRET_INCIDENT_IO` is a bounded legacy fallback for exactly one connected env-only row and is never an alternate key for connected per-org rows.

curl -X POST 'https://app.rensei.ai/api/webhooks/ingest/incident-io' \  -H 'webhook-id: string' \  -H 'webhook-timestamp: string' \  -H 'webhook-signature: string' \  -H 'Content-Type: application/json' \  -d '{  "event_type": "incident.created",  "data": {}}'

{  "ok": true,  "event_type": "string",  "created": true,  "updated": true,  "resolved": true,  "incidentId": "string"}