Webhooks verify locally but fail in production: the signing secret is from the wrong instance

# Symptom
Signature verification passes in local development (through a tunnel) and fails with 400 on the deployed environment.

# Confirm the cause
1. Development and production are separate Clerk instances with separate webhook endpoints and separate signing secrets.
2. Check which instance's endpoint page you copied the whsec_ secret from. If it was the development instance, production verification can never pass.
3. Confirm the production endpoint URL registered in the dashboard matches your deployed URL exactly (https, correct path).

# Fix
- Copy the signing secret from the PRODUCTION instance's endpoint page into your production env vars, keeping the dev secret in dev.
- Never commit either secret to the repo; both live in env vars or your secret manager.

# Verify
Use Send Test Event on the production endpoint and watch your production logs for a 200. Then trigger a real user.created event and confirm the handler runs.