Receive one provider webhook for a specific handoff connection.

The raw body is read before anything else and the signature verified over those exact bytes; only then is the JSON parsed. Everything the handler cannot act on — an unknown event type, an event for a handoff we cannot correlate, a redelivery — is answered 200 so the provider stops retrying. The genuine failures are 403 (bad signature) and 404/400 (unknown or unusable connection), none of which a retry would fix.