Webhook receiver with HMAC verification
Here is the BipBip Merchant API context: <paste llms-full.txt here>. Write a Node.js webhook receiver with Express that captures the raw body, verifies the HMAC-SHA256 signature from the X-Bipbip-Signature-256 header in constant time, and handles the order.created event by responding 200 with the remoteOrderId.