Internal service. This phase exposes a single signed webhook receiver:
POST /api/webhooks/surveyor-flow