Standardize Inkbox plugin behavior

[dimavrem22]

Summary

• Moves webhook HMAC verification before dedup so invalid signatures cannot poison request-id state.
• Standardizes request-id dedup with begin/commit/rollback semantics, in-flight suppression, and 5-minute TTL.
• Adds handler/dedup tests for invalid signatures, rollback, and concurrent duplicate suppression.
• Clarifies Realtime setup key persistence docs and refreshes stale dedup planning/changelog text.

Tests

• npx tsc --noEmit
• npm test
• npm test -- tests/inbound/dedup.test.ts tests/inbound/handler.test.ts tests/setup-wizard.test.ts

Notes

• Full failed-delivery recovery wakeups remain deferred to the follow-up delivery-failure PR set.