POST /api/v1/webhooks:
signing_secret once. Store it securely. Each request includes X-KolaVoice-Signature, which is an HMAC-SHA256 hex digest of the exact request body using that secret.
call.completed includes call_id, direction, status, ended reason, duration, cost, summary, and transcript. Webhook delivery is asynchronous and never blocks call finalization.
