Verification result callback outbound

When the user approves in their wallet, AnonAge POSTs your callback_url. Verify the signature before trusting the body: recompute HMAC_SHA256(signing_secret, "{t}.{rawBody}") and compare against v1 in the X-AnonAge-Signature header; reject if t is older than a few minutes.