feat: add volume-webhooks skill

[garethx]

Adds volume-webhooks for Volume (getvolume.com / volumepay.io), the UK open-banking pay-by-bank provider.

Scheme note: asymmetric RSA, not HMAC

• Authorization: SHA256withRSA <base64 signature>
• RSA PKCS#1 v1.5 + SHA-256 over the raw body. No timestamp and no shared secret.
• The public key is fetched per environment (https://api[.sandbox].volumepay.io/.well-known/signature/pem). The endpoint returns bare base64 SPKI with no PEM armour. Keys are cached for 1h, and the handler fails closed if the key can't be fetched.
• Deliveries are PUT; POST is also accepted.
• Events come from the body field paymentStatus: COMPLETED, SETTLED (virtual accounts only) or FAILED.

This matches Hookdeck core's VolumeController (same header prefix, padding, key endpoints and 1h cache; PUT+POST on the source type).

Verified: Volume's docs publish two curl samples signed with the sandbox key. Both verify against the live sandbox key with PKCS#1 v1.5 and fail with PSS or a one-byte change. The test suites use them as fixtures, with the sandbox public key embedded so the tests make no network calls. Please don't switch to PSS or HMAC in review.

The static source IPs in references/setup.md are verbatim from Volume's webhooks page. The skill presents them as optional extra protection on top of the signature check.

Testing

• validate-provider.sh volume-webhooks passes
• Express 30/30, Next.js 30/30, FastAPI 32/32
• No merchant account, so no live delivery test. The documented signed samples stand in for one.

🤖 Generated with Claude Code