CORS + idempotency + signed webhooks for /api/v1/*

Bearer auth on every /api/v1 route with no cookie surface → Access-Control-Allow-Origin: * is safe; browser-direct integrations work. Idempotency-Key header on every write endpoint that creates rows; per-entry clientMutationId on batch endpoints. Webhook deliveries signed with HMAC-SHA256 over `${timestamp}.${rawBody}` with 5-minute replay window.