Resend Webhook

Receive a Resend webhook event (delivery / bounce / complaint).

Verifies the Svix-style headers (svix-id, svix-timestamp, svix-signature) against RESEND_WEBHOOK_SECRET, then dispatches to the bounce/complaint suppression handler. Returns 200 with {"outcome": "processed" | "ignored"} on success or duplicate (Resend retries on non-2xx; duplicate must look like success).

Endpoint is unauthenticated — the Svix signature is the auth. Hard bounces and complaints flip users.email_suppressed_at so subsequent sends to that address skip the wire.