fix(webhook): reject replayed signatures

[gnanirahulnutakki]

Summary

• add a bounded, time-evicting replay cache for timestamp-protected webhook signatures
• reject exact replay attempts before handler dispatch
• add tests for replay rejection and window eviction

Issue

• ARD-451

Verification

Completed locally:

• cargo test -p ardur-webhook — passed

Currently running locally:

• cargo clippy --workspace --all-targets -- -D warnings && cargo test -p ardur-e2e-tests && cargo build --workspace --bins

Signed-off-by: Ardur team@ardur.ai

[linear-code]

ARD-451

[gnanirahulnutakki]

Required GitHub checks are green, but merge is blocked by base branch policy. I attempted the allowed paths and did not use admin bypass.

Evidence:

• DCO — passed
• macos-latest / stable — passed
• ubuntu-latest / stable — passed

Merge attempts:

• gh pr merge 181 --rebase --delete-branch failed: base branch policy prohibits the merge.
• gh pr merge 181 --rebase --auto --delete-branch failed: auto-merge unavailable (enablePullRequestAutoMerge).
• I did not use --admin.

Leaving this PR open/In Review pending authorized review/merge.