docs: describe the webhook signature as HMAC-SHA256 over the raw body (product update 2026-10-15) - #744

… and verify raw bytes in the Node sample (monorepo #4904)

The alerting daemon signs each webhook with HMAC-SHA256 over the exact body
bytes it sends, hex-encoded in x-checkly-signature. The page called this a
"SHA256 hash" of the payload, and the Node.js sample re-serialised the parsed
body with JSON.stringify, which cannot verify plain text bodies and breaks
whenever the serialisation differs from the sent bytes. The sample now reads
the raw body with express.raw(). One sentence documents that JSON payload
templates stay valid JSON when an inserted value contains a double quote or a
line break, and how {{VAR}} and {{{VAR}}} render a double quote.

Proven on the local stack at monorepo 5858d7e03f: three webhook jobs built by
the alerting daemon, replayed byte for byte to a local receiver; 3/3 signatures
match HMAC-SHA256(secret, raw bytes); flipped byte, plain SHA256 and the old
text rule mismatch; old sample fails the text body, new sample passes all.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>