🔐 Add webhook signature verification for Fal.AI webhooks

Fixes #26

🔍 Problem

Previously, Fal.AI webhooks were not secured, allowing anyone with the webhook URL to send malicious requests.

✨ Solution

Implemented HMAC-SHA256 signature verification similar to Clerk's Svix implementation.

📝 Changes Made

• ✅ Added verifyFalAIWebhook middleware for signature validation
• ✅ Secured /api/webhook/fal-ai/train endpoint
• ✅ Secured /api/webhook/fal-ai/image endpoint
• ✅ Updated README with FAL_WEBHOOK_SECRET configuration
• ✅ Created comprehensive WEBHOOK_SECURITY.md documentation

🛡️ Security Benefits

• Authentication: Only Fal.AI can send valid webhooks
• Integrity: Payload tampering is detected
• Consistency: Uses same pattern as Clerk webhooks

🧪 Testing

Signature verification can be tested with:

PAYLOAD='{"request_id":"123","status":"COMPLETED"}'
SIGNATURE=$(echo -n "$PAYLOAD" | openssl dgst -sha256 -hmac "$SECRET")
curl -H "x-fal-signature: $SIGNATURE" -d "$PAYLOAD" /webhook/fal-ai/train