G3.5: Eternitas revocation receiver — fail-closed, both signature traps avoided

When a passport is revoked, every credential it holds here dies in one
transaction: tokens revoked, grants revoked. A revocation that takes effect
'eventually' is not a revocation.

Avoids two traps that each cost a sibling service a subscription that looked
wired and never once delivered:
  1. strip the 'sha256=' prefix before comparing — comparing the decorated
     header against a bare digest returns 401 forever
  2. HMAC the RAW REQUEST BYTES, never a re-serialised body — JSON.stringify of
     a parsed body reorders keys and changes whitespace, so the digest never
     matches what the sender signed

Both fail silently from the sender's side: Eternitas records a delivery, the
receiver records a rejection, nobody notices for weeks.

Unset secret REFUSES rather than accepts — accepting unverified instructions
about identity is worse than missing them. And it never acknowledges a
revocation it could not apply; a 200 there is a security hole reporting success.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

api/app/config.py

@@ -46,6 +46,10 @@ class Settings(BaseSettings):
     # ---- Eternitas (agent identity + trust) -------------------------------
     eternitas_base_url: str = "https://api.eternitas.ai"
     eternitas_platform_api_key: str = ""
+    # Signs webhooks Eternitas delivers to us. Unset = we refuse them (I-8):
+    # accepting unverified instructions about identity is worse than missing them.
+    eternitas_webhook_secret: str = ""
+    eternitas_platform_id: str = ""
 
     # ---- account-server OIDC (human identity) -----------------------------
     account_server_base_url: str = "https://account.windyword.ai"