Receives Kick event webhooks (chat.message.sent, etc.).

Verify-and-acknowledge only: the RSA signature is verified against Kick's public key, a valid event returns 200, an invalid one 401. No database write happens here - the message-writer is a separate later patch.

The raw body MUST be read before any parsing - the signature is computed over the exact raw bytes.