Checkout approved

Sent when the provider approves the payment (DePix on the way to the merchant). On the depix rail it means the payer's transaction got its FIRST confirmation and was matched to this checkout — the money is already in the merchant's wallet, so this is the safe point to release goods. Sent to the checkout's callback_url (checkout-level, falling back to product/merchant defaults at creation time). Outbound POST to the merchant's callback URL, signed with X-DePix-Signature: t=<unix ts>,v1=<hex hmac-sha256> where the HMAC is computed over "${t}.${raw body}" with the merchant webhook secret. Verify the signature and reject stale timestamps. Delivery is retried on failure: immediate → 1m → 10m → 1h → 4h → 12h (max 6 attempts); use data.event_id to deduplicate. Respond with any 2xx quickly to acknowledge.