Verify and parse Unicom360 webhooks, and parse the unsigned SMS and email delivery reports.

WhatsApp events (message.status, message.received, webhook.test) are signed. Verify and parse a delivery with construct_event/4, passing the raw body, the request headers and your webhook secret (the 43-character string from the portal, used as it is: never base64-decode it):

case Unicom360.Webhook.construct_event(raw_body, conn.req_headers, secret) do
  {:ok, %Unicom360.Webhook.MessageStatusEvent{data: data}} -> data.status
  {:ok, %Unicom360.Webhook.MessageReceivedEvent{data: message}} -> message.text
  {:ok, %Unicom360.Webhook.TestEvent{}} -> :ok
  {:ok, %Unicom360.Webhook.UnknownEvent{event: event}} -> event
  {:error, %Unicom360.Error{type: :signature_verification_error, reason: reason}} -> reason
end

In Phoenix or Plug, Unicom360.Webhook.Plug does all of this, and Unicom360.Webhook.BodyReader keeps the raw body that Plug.Parsers would otherwise consume.

Good to know:

• Deliveries are retried on any non-2xx (after 30 s, 2 min, 10 min, 30 min, 1 h, 3 h, 6 h and 12 h). Answer 2xx quickly and drop repeats by the event's delivery_id.
• A secret that is nil, empty or only whitespace (an unset environment variable, say) is a :configuration_error before any other check, because anyone can forge a signature with an empty key. That is a fault in your configuration, not a failed verification: answer 500, not 401. Otherwise the secret is used exactly as given, never trimmed.
• In message.received: a media caption arrives in text, not in media; payload is set only for location, contacts (%{"contacts" => [...]}), reaction, sticker and unsupported messages; an interactive or button reply has the chosen title in text, payload is nil, and reply_to is the wamid. id of your interactive message (the button or row id is not passed on).
• SMS and email delivery reports (parse_sms_callback/1, parse_email_callback/1) are unsigned and never retried: anyone can post one, so treat them as hints.

Times are in milliseconds, as everywhere in this SDK: :tolerance defaults to 300_000 (five minutes) and :now is Unix time in milliseconds.