<?php
require_once './config.php';     // client DB creds & SIGN_KEY
$raw  = file_get_contents('php://input');
$calc = hash_hmac('sha256', $raw, CLIENT_SIGN_KEY);
if ($calc !== ($_SERVER['HTTP_X_HUB_SIGNATURE'] ?? '')) {
    http_response_code(401); exit('Bad signature');
}
$data = json_decode($raw, true);
if (!$data) { http_response_code(400); exit('Bad JSON'); }
