feat: blog articles resource and webhook verifier

[alihesari]

What

• client.blog: settings (get_settings, update_settings, rotate_website_secret, test_website), keywords (list_keywords, plan_keywords, add_keyword, update_keyword, delete_keyword) and articles (list_articles, request_article, get_article, update_article, regenerate_article, publish_article, reject_article, delete_article), with the BlogSettings, BlogSettingsUpdate, BlogWebsiteTest, BlogKeyword, BlogArticle, BlogArticleFull, BlogArticleImage models and the status/target-kind constants. Wire casing is camelCase throughout, including the workspaceId query key; callers pass snake_case keywords as elsewhere in the gem. 402 raises PaymentRequiredError, 409 raises Fopost::Error with the code, matching the existing map.
• Fopost::Webhooks.verify(raw_body, headers, secret): constant-time HMAC check over the raw bytes (OpenSSL.fixed_length_secure_compare), timestamped X-FoPost-Signature-256 preferred with a 300 s tolerance, plain X-FoPost-Signature only when no timestamp header is present. Returns a WebhookEvent; #article types the article.published payload as BlogArticlePublished. Raises Fopost::WebhookSignatureError.
• README Blog section and CHANGELOG entry under Unreleased.

How to verify

bundle exec rake   # minitest (204 runs) + rubocop, both green

test/blog_test.rb pins paths, methods, query and body shapes per group; test/webhooks_test.rb covers a valid timestamped signature, a tampered body, a stale timestamp, and the legacy body-only fallback.

Release

No version bump; releases are batched. fopost-rails wrapper follows separately.