Circle Wallet Created Webhook

Public Circle wallets.created webhook.

Signature verification uses the RSA-PKCS1v15-SHA256 helper in app.circle_mint (matches Circle's documented webhook security scheme — they sign with their private key, we verify with their published public key). The task spec said "HMAC" but Circle's real webhook model is RSA; we use the established verify helper rather than implementing a parallel HMAC path that would break the first real Circle ping.

Headers expected

X-Circle-Signature — base64 RSA-PKCS1v15-SHA256 over the raw body X-Circle-Key-Id — Circle public key identifier (used to fetch the PEM from /v2/notifications/publicKey)

On signature mismatch returns 401. On unparseable body returns 400. On any successful match dispatches to circle_embedder_wallets.handle_provision_webhook for the actual DB write.