Resend webhooks: local testing with tunnels and secret rotation

# Local testing and secret rotation for Resend webhooks

## Local development

1. Expose your local server with a tunnel: ngrok http 3000, or Tailscale Funnel for a permanent URL.
2. Point a Resend webhook (a dev one, not production) at the tunnel URL and subscribe to the events you are building for.
3. Trigger real events (send a test email, force a bounce with a bad address) rather than hand-crafting payloads. Real events carry the real signature headers, which is what you are actually testing.
4. When your handler logic changes, replay a past event from the dashboard or API instead of regenerating the scenario. Replay re-sends the identical payload with a valid signature.

## Secret rotation

1. If the signing secret leaks, or on a schedule, call the rotate method (resend.webhooks.rotateSigningSecret in Node). The response contains the new whsec_ secret.
2. Update your environment variable immediately. For 24 hours after rotation, Resend dual-signs payloads with both the old and new secrets, then only the new one.
3. Your verifier must accept any valid v1 signature in the svix-signature header, not just the first, or rotation windows will break verification.

## The trap

Testing with unsigned hand-made payloads and a skipped verification step, then shipping a verifier that has never seen a real signature. The other trap is rotating the secret and forgetting the env var: every webhook fails verification until you update it, and the failure looks exactly like an attack.