Each user gets a unique secret token embedded in their webhook URL
(/webhook/:token). Credentials are loaded from users.json at startup
instead of environment variables, making it easy to add or remove users
without redeploying.
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
