Recipient download URL

Receives Persona's inquiry events. Called by Persona only — there is no session, and the request is authenticated by the Persona-Signature header (t=<unix time>,v1=<hex HMAC-SHA256 of "<t>.<raw body>">, one space-separated pair per secret while a secret is being rotated), checked against PERSONA_WEBHOOK_SECRET over the raw body before it is parsed. The event is only a signal. The inquiry it names is read back from Persona, and that answer — never the payload — decides. The inquiry must be held by exactly one verification row, with the same recipient as its reference id and the configured Inquiry Template. Only the approved decision verifies the recipient: declined and failed move it to failed, expired to expired, and completed, needs_review, or any status this service does not know changes nothing. A settled verification never moves again, so redeliveries and out-of-order events are harmless, and an event about an inquiry that has since been replaced matches no row. An event for a document that is no longer signable (completed, declined, voided, expired, or this recipient already signed or declined) is ignored. Events that are not for this service are acknowledged with 200 so Persona stops retrying them. Only a failure a retry could fix (503: Persona could not be read, 500) asks for redelivery.