Receive webhook events from Xero.

Xero sends an empty events list to validate the endpoint ("intent to receive"); a valid signature (checked in the route dependency) is enough for that handshake, so we simply acknowledge with 200. Real events are handed to a service that publishes a domain event per invoice for out-of-band processing.