Email delivery callback (delivered / bounced / complained)

Called by the email provider, not by partners. **Unauthenticated** — Resend cannot present a Haavisa API key, so the body is authenticated by its Svix signature instead (`svix-id`, `svix-timestamp`, `svix-signature`), which also carries the replay clock: a timestamp outside five minutes is refused.

The event is matched to the notification it is about by the provider’s own message id, and only `delivery_status` and `delivered_at` move — `status` keeps saying whether *we* managed to hand the message over, because “we never sent it” and “they took it and the address did not exist” are different facts and a bounce is the one worth acting on.

An event for a message this system does not hold is acknowledged with `matched: false` rather than refused: that is the ordinary case for anything sent before the endpoint existed, and a 4xx would have the provider retrying history. Without `RESEND_WEBHOOK_SECRET` the route answers 503 and refuses everything — unverified delivery events would let anyone mark an applicant’s mail as delivered.