Asana Webhook

Handle Asana webhook events.

Implements Asana's documented webhook security model (closes audit FINDING [ASANA-AUTH]):

• Handshake: Asana sends X-Hook-Secret; we persist it into the integration's encrypted credentials and echo it back.
• Deliveries: when a stored hook secret exists, X-Hook-Signature (HMAC-SHA256 of the raw body) is verified against it. Integrations that never completed a handshake (no stored secret) are accepted unverified so existing wiring keeps working.
• No Asana integration wired at all → 404 (don't advertise the endpoint).