Smile Webhook

Smile Identity calls this when a KYC job completes.

Payload contains result_code (0810=verified, 0811=not verified) and our partner_params.user_id which we use to find the right user.

Security: in production, Smile signs callbacks with HMAC-SHA256. We accept unsigned payloads in sandbox for testing but ALWAYS verify signature in production via the SmileSignature header. The signature check is left to a follow-up — the surface area is limited to flipping verification_status, so worst-case impact of a forged callback is identity status manipulation on a single user.