Handles Xendit payment webhook callbacks.

Xendit sends callbacks when payment status changes (paid, expired, failed, etc.). The X-CALLBACK-TOKEN header is verified against the configured VOILE_XENDIT_WEBHOOK_TOKEN to ensure the request originates from Xendit before any payment state is mutated.