fix: batch 3 — webhook HMAC documentation + CSRF rate limiting

- Webhook HMAC: added consumer verification JSDoc with Node.js example using crypto.timingSafeEqual
- CSRF rate limiting: 20 requests/15min per IP on NextAuth /csrf endpoint
- Renamed withRateLimit to withPostRateLimit/withGetRateLimit for clarity
- 429 responses include Retry-After header

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/server/services/webhook-dispatcher.ts

@@ -2,6 +2,46 @@ import crypto from 'crypto'
 import { Prisma } from '@prisma/client'
 import { prisma } from '@/lib/prisma'
 
+/**
+ * MOPC Webhook Signature Verification
+ * ====================================
+ *
+ * Every outbound webhook delivery is signed with HMAC-SHA256 using the
+ * webhook's shared secret. The signature is sent in the `X-Webhook-Signature`
+ * header with a `sha256=` prefix.
+ *
+ * Additional headers included with each delivery:
+ *   - X-Webhook-Event:     the event type (e.g. "evaluation.submitted")
+ *   - X-Webhook-Delivery:  unique delivery ID (UUID)
+ *
+ * To verify a delivery on the consumer side:
+ *
+ *   // Node.js example
+ *   const crypto = require('crypto');
+ *
+ *   function verifySignature(secret, body, signatureHeader) {
+ *     const expected = 'sha256=' + crypto
+ *       .createHmac('sha256', secret)
+ *       .update(body, 'utf8')    // raw request body string
+ *       .digest('hex');
+ *     return crypto.timingSafeEqual(
+ *       Buffer.from(expected),
+ *       Buffer.from(signatureHeader),
+ *     );
+ *   }
+ *
+ *   // In your handler:
+ *   const sig = req.headers['x-webhook-signature'];
+ *   if (!verifySignature(WEBHOOK_SECRET, rawBody, sig)) {
+ *     return res.status(401).send('Invalid signature');
+ *   }
+ *
+ * IMPORTANT:
+ *   - Always verify against the raw request body (before JSON parsing).
+ *   - Use timing-safe comparison to prevent timing attacks.
+ *   - The secret can be regenerated via the admin UI (Settings → Webhooks).
+ */
+
 /**
  * Dispatch a webhook event to all active webhooks subscribed to this event.
  */