[samad13]

Summary

• Align incoming webhook verification with versioned HMAC signatures, preserve legacy signature support, and resolve integration secrets asynchronously.
• Process risk evaluations through the BullMQ risk-analysis queue, persist retry-safe assessments, and flag transactions that require approval.
• Confirm the requested composite indexes and API-key authentication guard are already present in the schema/migration history and auth module.

Validation

• Full test suite: 1,831 tests passed.
• npm run db:verify passed; database replay was skipped because no shadow database URL was configured.
• Typecheck and lint passed.

Closes #422
Closes #423
Closes #431
Closes #432

[drips-wave]

@samad13 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[Cjay-Cyber-2]

The branch now conflicts with current main across transaction/webhook/risk changes. I am holding it rather than guessing at behavior-changing conflict resolution; please rebase the branch onto main, resolve the conflicts, and rerun the green CI checks.