Receive Slack Events API callbacks.

Handles:

• url_verification: returns the challenge value for endpoint verification.
• event_callback with message type: creates a task when the bot is mentioned. Bot messages and message_changed subtypes are ignored to prevent loops.

Reads SLACK_SIGNING_SECRET from environment for HMAC verification. The secret MUST be configured: when it is not, the endpoint is disabled and returns UNCONFIGURED_STATUS; only signed Slack requests are accepted. Note that the url_verification handshake is signed by Slack too, so registering the endpoint works normally. Payload shape is validated before it is read: the body and, when present, its event member must both be JSON objects. Returns 200 on success, 401 on bad/missing signature, 400 on parse error or malformed payload shape, UNCONFIGURED_STATUS when the endpoint is not configured.