Replace URL token auth with the official webhook secret signature check. Add SETUP.md and separate TEST_TOKEN for the Postmark test endpoint. Co-authored-by: Cursor <cursoragent@cursor.com>
