Payment provider callback

Called by the payment provider, not by partners. **Unauthenticated** — a provider cannot present a Haavisa API key, so the request is authenticated by signature instead, and a bad signature is a 400 because it is an unauthenticated instruction to move money.

Delivery is at-least-once and duplicates are expected: the provider and event id are unique together, so a redelivery is acknowledged without reprocessing. An unknown provider is acknowledged rather than rejected, so a misconfiguration cannot cause a retry storm.