Receive a SignWell signing event (public, HMAC-authenticated)

Inbound SignWell event receiver for the test-only MSA e-signature POC. Authenticated by the event's HMAC over type@time, which is why the body is treated only as a hint: the event marks a known signature request due, and the transition is made by re-reading and re-verifying the document from the vendor. Unknown documents produce no write, and the ack is constant.