feat: Speakeasy API client bootstrap (PDE-755)

[mekilis]

Summary

• Bootstrap Speakeasy generation from frain-dev/convoy docs/v3/openapi3.yaml
• Keep webhook signature verification hand-written (shared signature-vectors.json)
• Bump toward a new major so the first Speakeasy generation is an intentional API-shape break
• Add CI that regenerates via Speakeasy and still runs verify vector tests

Secrets required

• SPEAKEASY_API_KEY on this repository (Actions)
• SDK_BOT_PAT on this repository so generation PRs trigger verify CI (PRs opened with GITHUB_TOKEN do not fire pull_request workflows)

Follow-up

After merge, run SDK Generation (sdk_generation.yaml) with force=true to open the first generated API-client PR.

Related: PDE-755 / frain-dev/convoy Speakeasy workflow.

---

Note

Medium Risk
Changes affect webhook verification error paths and CI packaging gates; behavior is stricter (fail-closed) but aligned with existing verify vectors.

Overview
CI no longer tolerates a failed pip install -e . once pyproject.toml is present. A new step imports Webhook without PYTHONPATH, and pytest runs against the installed distribution in that case so packaging gaps (e.g. missing convoy.utils.webhook) fail the build instead of being masked by src/.

Packaging drops the legacy setup.py in favor of Speakeasy-provided pyproject.toml on first generation; pre-generation runs still use PYTHONPATH=src for verify tests.

Webhook verify tightens typing on exception constructors, chains InvalidSignature / InvalidTimestampError from underlying decode/parse errors, and makes create_signature / create_advanced_signature raise InvalidSignature for unsupported encodings instead of returning None.

^{Reviewed by Cursor Bugbot for commit 23481f3. Bugbot is set up for automated code reviews on this repo. Configure here.}