Sign-up notification webhook (shared secret)

POST /hooks/signup · API key required

Called by the database trigger on `auth.users` (sql/044) when a developer signs up. Sends one Telegram message with the sign-up method and whether the address is confirmed. The email and user id are never sent. Authenticated with the `x-webhook-secret` header (`SIGNUP_WEBHOOK_SECRET`), not a bearer token. Events other than an INSERT on auth.users are skipped with a 200.