fix(security): add auth to FCM relay, HMAC to shamcash webhook, fix jwtconnect webhook bypass

walletintaleq.intaleq.xyz/v2/main/jwtconnect.php

@@ -93,11 +93,11 @@ try {
     }
 
     // --- Path 3: Webhook Auth Token (MTN/Cliq external services) ---
-    // ملاحظة: البوابة تعترف بوجود الهيدر فقط. كل webhook يتحقق من القيمة الفعلية بنفسه.
     if (!$authMethod) {
         $webhookToken = $_SERVER['HTTP_X_AUTH_TOKEN'] ?? '';
+        $expectedWebhook = getenv('WEBHOOK_AUTH_TOKEN');
         
-        if (!empty($webhookToken)) {
+        if (!empty($expectedWebhook) && !empty($webhookToken) && hash_equals($expectedWebhook, $webhookToken)) {
             $authMethod = 'WEBHOOK';
         }
     }