fix(seed): honor a pinned webhook signing secret

[gjtorikian]

Summary

• webhookEndpoints[].secret in the seed config is now honored (whConfig.secret ?? randomBytes(...)), matching what POST /webhook_endpoints already accepts — and the same convention as apiKeys[].value and connectApplications[].client_secret: a service needs known credentials before anything talks to the emulator.
• This was the one seeded value a caller could not discover afterwards: the API masks an endpoint's secret after creation (abc12345****), so a signature-verifying consumer had to register its endpoint over the API — which in-memory state loses on restart, silently stopping deliveries.
• validateSeedConfig rejects a non-string or empty secret next to the existing events check, and the README's webhook registration section now shows the pinned secret in the seed YAML.
• New spec proves a pinned secret is what actually signs deliveries: a receiver verifies the WorkOS-Signature HMAC with the pinned value, an omitted secret still gets a generated one, and the validator accepts/rejects correctly.

Fixes #74

[greptile-apps]

Greptile Summary

The PR allows seed configuration to pin webhook signing secrets while retaining generated secrets when omitted.

• Adds secret to the public seeded webhook endpoint configuration.
• Validates provided secrets as non-empty strings before seeding.
• Uses the pinned value for webhook HMAC signatures and documents the configuration.
• Adds integration coverage for pinned and generated secrets.

Confidence Score: 5/5

The PR appears safe to merge with no actionable correctness or security issues identified.

Validation precedes all seed insertion paths, endpoint indexing occurs after seeded inserts, and the configured secret reaches HMAC signing unchanged while omission retains the existing generated-secret behavior.

Important Files Changed

Filename	Overview
src/workos/index.ts	Adds the optional seed field and persists it unchanged, with the existing random-secret fallback preserved.
src/workos/config-validator.ts	Rejects empty and non-string webhook secrets before any seeded endpoint is inserted.
src/workos/seed-webhook-secret.spec.ts	Verifies real delivery signatures for pinned secrets, generated-secret fallback behavior, and validation outcomes.
README.md	Documents how and why consumers can pin a seeded webhook signing secret.

_{Reviews (1): Last reviewed commit: "fix(seed): honor a pinned webhook signin..." | Re-trigger Greptile}