Airwallex Payouts

- SECURITY: Webhook signature verification now fails CLOSED. Previously, if no webhook secret was configured, verification returned success, allowing an attacker to forge transfer status events. It now rejects the webhook. ACTION REQUIRED: configure the Webhook Secret to continue receiving Airwallex webhook status updates.
- SECURITY: Webhook replay protection. The signed x-timestamp is now validated for freshness (5-minute window), so a captured valid webhook can no longer be replayed indefinitely.
- SECURITY: Transfer creation now sends a stable request_id (derived from the payout reference) as the Airwallex idempotency key. Previously a retry after a lost/timed-out response could create and fund a second transfer (double payout).
- Transfers are only reported successful when the response contains a transfer id; a 2xx body with no id is now treated as failed so it can be reconciled instead of being silently marked paid.
- Webhook status is now derived from the event name (transfer.failed/returned/etc.) when the payload omits a status field, so a failed or returned payout is no longer recorded as still-pending.
- Beneficiaries are reused when one already exists for the recipient's account instead of creating a duplicate on every payout/retry.
- Money amounts are quantized to the currency's minor units and sent as exact JSON numbers instead of via float(), correctly handling zero-decimal (JPY) and three-decimal (KWD/BHD/OMR) currencies.
- API responses that are not JSON (e.g. an HTML 502 from a gateway) no longer raise; the raw text is preserved instead.

- Initial release
- Bank transfer support (LOCAL and SWIFT)
- Bearer token authentication with automatic refresh
- Webhook signature verification
- Fee estimation support
- Demo and Production environment support