Messaging-provider webhooks
Delivery-receipt and inbound callbacks for the SMS/WhatsApp providers that don't HMAC-sign — MSG91 (SMS) and Gupshup (WhatsApp). Token-authenticated, fail-closed, and normalized into the same provider-neutral, monotonic status pipeline as Twilio and Meta.