Registrar webhooks do comerciante

curl -X POST https://api.clearpago.com.br/webhook \
  -H "Authorization: Bearer <seu_api_token>" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://seu-sistema.com/webhooks/pix",
    "events": [
      "pix_cash_in",
      "pix_cash_out",
      "pix_cash_in_reversal",
      "pix_cash_out_reversal"
    ]
  }'

curl https://api.clearpago.com.br/webhook \
  -H "Authorization: Bearer <seu_api_token>"

curl -X DELETE https://api.clearpago.com.br/webhook/{webhook_id} \
  -H "Authorization: Bearer <seu_api_token>"

app.post('/webhooks/pix', async (req, res) => {
  const rawBody = req.rawBody; // buffer bruto, antes do parse JSON
  const signature = req.headers['digital-signature'];

  // 1. Verificar assinatura
  const isValid = verifyEcdsaSignature(publicKey, rawBody, signature);
  if (!isValid) {
    return res.status(401).json({ error: 'Invalid signature' });
  }

  // 2. Responder 2xx imediatamente
  res.status(200).send();

  // 3. Processar de forma assíncrona
  await queue.push({ body: req.body });
});