Verify the signature, normalize the event, and reconcile it onto the tenant's subscription. Returns 200 for anything verified (even events we ignore) so Paddle doesn't redeliver; an unverifiable signature raises → 400. The transactional route commits before responding.

The raw body goes to the verifier undecoded — the HMAC covers exactly these bytes, and a body that isn't UTF-8 is the verifier's 400 to raise, not an unhandled decode error on an anonymous endpoint.