Clerk Account Webhook

Reconcile a person's is_active with Clerk's authoritative account state.

Disabled (503) when clerk_account_sync_enabled is false or the webhook secret is unset - both are configuration states, not signature failures, and 503 (not 200 or 404) is what tells Clerk's dashboard "this endpoint is not ready" rather than "delivered fine".

The payload's own data is used ONLY to find which Clerk user id the event is about; every flag/timestamp it carries is deliberately ignored - the worker re-fetches Clerk's CURRENT state under a row lock instead of trusting anything the delivery itself claims. This is what makes a stale or reordered delivery, and a user.deleted event for a user recreated under the same id, both safe to apply.