Function verify_signature 

pub fn verify_signature(body: &[u8], signature: &str, secret: &[u8]) -> bool

Verify a webhook signature (hex HMAC-SHA256) against the exact raw body using secret. Comparison is constant-time for valid signature lengths.

This authenticates the payload but does not provide replay protection.