The webhook sender reads the endpoint at send time, drops jobs for
deleted or disabled endpoints, and decrypts the endpoint secret
(AES-256-GCM, WEBHOOK_SECRET_KEY) to sign "<timestamp>.<body>".
The client checks the dialed IP after DNS, never uses a proxy and never
follows redirects. Each try writes a delivery_attempt row.
410 disables the endpoint and kills the job, 429 honors Retry-After,
everything else non-2xx retries with backoff.