feat: blog articles resource and webhook verifier

[alihesari]

What

• client.blog(): settings (getSettings, updateSettings, rotateWebsiteSecret, testWebsite), keywords (listKeywords, planKeywords, addKeyword, updateKeyword, deleteKeyword) and articles (listArticles, requestArticle, getArticle, updateArticle, regenerateArticle, publishArticle, rejectArticle, deleteArticle), with BlogSettings, BlogKeyword, BlogArticle, BlogArticleFull, BlogArticleImage records and the BlogArticleStatus, BlogKeywordStatus, BlogTargetKind constants. workspaceId rides on the query string for GET/PATCH/DELETE and in the body for POST/PATCH /settings, /keywords, /keywords/plan, /articles. 402 maps to PaymentRequiredException, 409 to FoPostException with the code, as elsewhere.
• WebhookVerifier.verify(rawBody, headers, secret) (also client.webhooks().verify): HMAC-SHA256 via javax.crypto.Mac, constant-time compare via MessageDigest.isEqual, timestamped X-FoPost-Signature-256 preferred with a 300 s tolerance, body-only X-FoPost-Signature only when no timestamp header is sent. Returns WebhookEnvelope {event, data, timestamp}; envelope.data(BlogArticlePublished.class) types the article.published payload. WebhookEvents.ARTICLE_PUBLISHED added.

How to verify

mvn -B verify (148 tests, 0 failures, warning-free). BlogTest covers one case per resource group against FakeTransport; WebhookVerifierTest covers a valid timestamped signature, a tampered body, a stale timestamp and the legacy body-only signature.

Release

No version bump; releases are batched. fopost-spring needs no change to compile, but should gain the blog() passthrough when the SDK is released.