Never trust a payment webhook on its first word

A payment webhook is a POST from a stranger claiming money moved. Log it, authenticate it, confirm with the gateway, lock and re-check, and only then touch the order.