Add invoice creation, quoting, and webhook signature verification

Finishes the two gaps that mattered most for real use: Invoices#create
(POST invoices) + Invoices#quote (POST invoices/{id}/quote, returning
the new Quote model with the actual payable bolt11 — an invoice alone
has nothing payable until quoted) and Webhook.valid_signature?
(HMAC-SHA256 over the raw body via X-Webhook-Signature, per Strike's own
documented reference implementation, timing-safe compare). Also finishes
Invoices#find (was a stub with a leftover binding.pry) and adds
WebhookEvent to parse the {id, eventType, data: {entityId, changes}}
payload shape — deliberately doesn't expose changed values, since
Strike's webhooks never carry them; a real value only ever comes from
re-fetching the resource.

Client gains #post/#patch (only #get existed before), needed for both
of the above.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0199wudpuAtkhouHKSEGxzpa

lib/strike_me/api/webhook.rb

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+require 'openssl'
+require 'active_support/security_utils'
+
+module StrikeMe
+  module API
+    # Verifies the X-Webhook-Signature header Strike attaches to every
+    # webhook POST — HMAC-SHA256 of the raw request body, keyed by the
+    # secret set at webhook-subscription creation time. See
+    # https://docs.strike.me/webhooks/signature-verification — this
+    # mirrors Strike's own documented reference implementation exactly
+    # (hex digest, timing-safe compare), just in Ruby.
+    #
+    # `raw_body` must be the exact bytes Strike sent, before any
+    # JSON-parsing round-trip — re-serializing a parsed body can reorder
+    # keys or change whitespace and silently break verification.
+    module Webhook
+      SIGNATURE_HEADER = 'X-Webhook-Signature'
+
+      def self.valid_signature?(raw_body:, signature:, secret:)
+        return false if signature.blank? || raw_body.blank?
+
+        expected = OpenSSL::HMAC.hexdigest('SHA256', secret, raw_body)
+        secure_compare(expected, signature)
+      end
+
+      # ActiveSupport::SecurityUtils.secure_compare raises on a length
+      # mismatch rather than returning false — a garbled/truncated header
+      # from a malformed request should fail closed, not raise.
+      def self.secure_compare(expected, actual)
+        return false unless expected.bytesize == actual.bytesize
+
+        ActiveSupport::SecurityUtils.secure_compare(expected, actual)
+      end
+    end
+  end
+end