Accepts a public token URL and checks the endpoint's verification: a Standard Webhooks signature (`webhook-id`, `webhook-timestamp` and `webhook-signature` within five minutes), the hex HMAC-SHA256 of the body in the endpoint's signature header, or the token alone. Verified deliveries are stored and start matching workflows shortly after; a repeated `webhook-id` is stored once. Bodies over 256 KB are rejected.