POST /api/docuseal/webhook/<token> validates the path token against
DOCUSEAL_WEBHOOK_TOKEN, persists every event to docuseal_events with
the full payload as jsonb, and emails Will via Resend on form.completed
or form.declined. Token rotates via Secret Manager.
Will Anderson