Fix critical webhook signature case bug; add correlationId + AR type registration

Strike sends X-Webhook-Signature in UPPERCASE hex. OpenSSL::HMAC.
hexdigest always returns lowercase, and valid_signature? compared them
case-sensitively via secure_compare — every genuine Strike webhook was
being silently rejected as an invalid signature. Confirmed live: executed
a real Lightning payment (payment-quotes/lightning + PATCH .../execute),
received a real payment.updated webhook, and recomputing the HMAC over
the captured payload/secret matched case-insensitively but not
case-sensitively — proving the algorithm/secret/body were already
correct and this was purely a case-comparison bug. Their own reference
docs (docs.strike.me/webhooks/signature-verification) don't mention the
case difference. Regression test added using the real captured signature,
upcased.

Also, both found via that same live test:
- Invoices::Invoice didn't declare correlationId, raising
  ActiveModel::UnknownAttributeError the moment a real one (which
  CreateInvoice always sends) round-tripped through a live response —
  no existing spec fixture's stubbed body had included it.
- BtcAttributeType was only registered with ActiveModel::Type, not
  ActiveRecord::Type (a separate registry) — an `attribute :x,
  :strike_btc` declaration on an ActiveRecord model raised "Unknown
  type" without this. Guarded behind defined?(ActiveRecord::Type) since
  this gem only depends on active_model.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

spec/strike_me/api/webhook_spec.rb

@@ -10,6 +10,17 @@ RSpec.describe StrikeMe::API::Webhook do
       expect(described_class.valid_signature?(raw_body: raw_body, signature: real_signature, secret: secret)).to eq true
     end
 
+    # Strike sends X-Webhook-Signature in UPPERCASE hex — confirmed live
+    # against a real payment.updated delivery 2026-09-22 (executed a real
+    # Lightning send, received a real signed webhook). OpenSSL::HMAC.
+    # hexdigest always returns lowercase; without downcasing both sides
+    # this rejected every genuine Strike webhook, silently, since a
+    # rejected webhook is indistinguishable from an actual forgery
+    # attempt from outside.
+    it 'is true for the real signature even when Strike sends it as UPPERCASE hex' do
+      expect(described_class.valid_signature?(raw_body: raw_body, signature: real_signature.upcase, secret: secret)).to eq true
+    end
+
     it 'is false for the wrong secret' do
       expect(described_class.valid_signature?(raw_body: raw_body, signature: real_signature, secret: 'wrong')).to eq false
     end