Handle an inbound Merge webhook POST.

Validates the payload, deduplicates by signature, resolves the connection, checks sync-status safety from the webhook payload, and dispatches a transaction refresh task when all preconditions pass.

Args: request: DRF request with HMAC-verified request.auth signature.

Returns: JsonResponse with status indicating the outcome: duplicate, ignored, skipped, or accepted (HTTP 202).