Security

• HMAC-SHA256 over timestamp + "." + rawBody.
• Header X-ROS-Signature: sha256=<hex>.
• Replay window 5 minutes.
• API secret (inbound) and webhook secret (outbound) are different keys.
• Developer tokens cannot call restaurant GET /v1/me.
• Restaurant tokens cannot read developer credentials.

Placeholders in examples: YOUR_API_KEY, YOUR_WEBHOOK_SECRET. Never commit live secrets.