Developer-only interface for testing billing & payments
Webhook signature uses HMAC SHA-256 hex of the raw JSON body.