Receive SendGrid Event Webhook deliveries and persist them in-process.

Unauthenticated — SendGrid posts here directly (this is the public, internet-facing surface). Signature verification + persistence live in the notification domain; delegate to its handler, which reads the raw body before any re-serialization so the signature check stays valid. Returns 403 on a bad signature, which SendGrid retries with backoff.