Webhook retries that actually land

Outbound webhooks fail for boring reasons: cold starts, 5xx spikes, DNS blips. Treating a single POST as success is how integrations silently drift.

CanWeChat signs every payload with HMAC-SHA256 over timestamp and body, queues failed deliveries, and keeps a short history with HTTP status plus a truncated response body.

Receivers should verify the signature and key off an event id. Retries are expected; idempotent handlers are the contract, not optional polish.