fix(webhook): verify Juniper Mist v2 signatures

[robb404]

Summary

• accept Juniper Mist X-Mist-Signature-v2 webhook signatures
• verify the documented raw-body HMAC-SHA256 hex digest with constant-time comparison
• add positive and tampered-body regression coverage

Problem

Mist signs webhook bodies with X-Mist-Signature-v2, but the generic webhook adapter did not recognize that header, so correctly signed Mist deliveries were rejected with HTTP 401.

Test plan

• RED: valid Mist v2 signature returned 401 before implementation
• tests/gateway/test_webhook_signature_rate_limit.py — 3 passed
• webhook-focused suite — 65 passed before the additional tamper regression
• Ruff check passes for both changed files
• Live provider acceptance: Mist ping traversed Cloudflare Access and Hermes and returned HTTP 200; tampered local body returned 401

No signature secrets or environment-specific configuration are included.