Revenuecat Webhook

Primary entitlement webhook. RevenueCat normalises Play (and later Apple) state changes into a single event shape:

{ "event": { "type": "INITIAL_PURCHASE", "app_user_id": "<uuid>",
             "product_id": "premium_monthly", "transaction_id": "...",
             "expiration_at_ms": 123, "auto_renewing": true, ... } }

Auth: the shared secret configured in the RC dashboard arrives in the Authorization header (RC sends it verbatim, no Bearer prefix). We compare with hmac.compare_digest to avoid timing leaks.