huskies: merge 807

server/src/chat/transport/matrix/config/types.rs

@@ -136,6 +136,12 @@ pub struct BotConfig {
     /// fail-closed).
     #[serde(default)]
     pub whatsapp_allowed_phones: Vec<String>,
+    /// Meta app secret used to verify `X-Hub-Signature-256` HMAC on inbound
+    /// webhook requests.  When set, every POST to `/webhook/whatsapp` must
+    /// carry a valid signature or the request is rejected.  When absent or
+    /// empty, signature verification is skipped (backwards compatible).
+    #[serde(default)]
+    pub whatsapp_app_secret: Option<String>,
 
     // ── Slack Bot API fields ─────────────────────────────────────────
     // These are only required when `transport = "slack"`.