settlement-engine webhook signing uses the raw JSON body string ordering

[therealjhay]

ProblemsignPayload signs JSON.stringify({ event }); property order is deterministic for the same object, but any reserialization (logging, storing, resending) changes the body and invalidates the signature.

1. Signing depends on serialization order.
2. Re-delivery with re-serialized body fails signature.
3. No canonicalization.

Solution

• Canonicalize the payload before signing and on verification.
• Sign and verify with the same canonical form.
• Test reserialization stability.

Acceptance Criteria

• Signature survives canonical re-serialization.
• Verification matches.
• pnpm --filter @bettapay/webhook-delivery build passes.

Note for Contributors: Write a clear PR description. Show a canonicalization test.

[khaylebfortune]

Hello Maintainer, I can fix this issue.
Please assign me.

[grantfox-oss]

🦊 GrantFox — @khaylebfortune has been assigned to this issue as part of the Third Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #567)
2. Your PR will be reviewed by the Betta-Pay maintainers

Good luck! Track your progress on GrantFox.