Add invoice creation, quoting, and webhook signature verification

Finishes the two gaps that mattered most for real use: Invoices#create
(POST invoices) + Invoices#quote (POST invoices/{id}/quote, returning
the new Quote model with the actual payable bolt11 — an invoice alone
has nothing payable until quoted) and Webhook.valid_signature?
(HMAC-SHA256 over the raw body via X-Webhook-Signature, per Strike's own
documented reference implementation, timing-safe compare). Also finishes
Invoices#find (was a stub with a leftover binding.pry) and adds
WebhookEvent to parse the {id, eventType, data: {entityId, changes}}
payload shape — deliberately doesn't expose changed values, since
Strike's webhooks never carry them; a real value only ever comes from
re-fetching the resource.

Client gains #post/#patch (only #get existed before), needed for both
of the above.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0199wudpuAtkhouHKSEGxzpa

lib/strike_me/api/invoices.rb

@@ -8,6 +8,7 @@ module StrikeMe
       include Enumerable
 
       autoload_default :Invoice
+      autoload_default :Quote
 
       delegate :first, :last, :size, :any?, to: :list
 
@@ -25,6 +26,51 @@ module StrikeMe
 
         @list = response.body['items'].map { |item| Invoice.new item }
       end
+
+      def paid
+        select(&:paid?)
+      end
+
+      def find(id)
+        url = "invoices/#{id}"
+        response = client.get url
+
+        raise ResponseError.new(url, response.body) unless response.success?
+
+        Invoice.new response.body
+      end
+
+      # POST invoices — amount is a decimal string per Strike's own API
+      # (not a float/BTC value), matching what #list/#find already hand
+      # back untouched in Invoice#amount.
+      def create(amount:, currency:, description: nil, correlation_id: nil)
+        url = 'invoices'
+        body = {
+          amount: { amount: amount, currency: currency },
+          description: description,
+          correlationId: correlation_id
+        }.compact
+        response = client.post(url, body)
+
+        raise ResponseError.new(url, response.body) unless response.success?
+
+        Invoice.new response.body
+      end
+
+      # POST invoices/{id}/quote — the second step of actually getting a
+      # payable BOLT 11 (Invoice#create alone only reserves the invoice
+      # shell; nothing is payable until a quote exists). Quotes expire
+      # (Quote#expiration) — callers request a fresh one per payment
+      # attempt rather than caching.
+      def quote(id, description_hash: nil)
+        url = "invoices/#{id}/quote"
+        body = { descriptionHash: description_hash }.compact
+        response = client.post(url, body)
+
+        raise ResponseError.new(url, response.body) unless response.success?
+
+        Quote.new response.body
+      end
     end
   end
 end