Callback delivery

Merchant callbacks are verified and stored by the hub, then delivered to platform: at least once, retried with backoff, dead-lettered when retries run out. Dead letters can be redelivered here. The hub does not dedupe: an upstream re-push is a new event, handled idempotently by platform from the raw body.