How SaaSQuickStart delivers signed webhooks: HMAC-SHA256 signatures, SSRF-guarded transport, a 10s timeout, and durable retries (1m/5m/30m) that survive a restart.