Webhooks and errors

Courier callbacks should acknowledge quickly after the raw event is persisted. Status mapping and notification work happen after that boundary so provider retries do not create duplicate work.

Error behavior

Treat 400 as an input problem, 402 as a billing lock, 404 as a missing resource, and 429 as a retryable cooldown. When a response includes Retry-After, respect it before attempting another courier sync.

Keep webhook credentials and raw customer data out of application logs.