SAMPLE EVIDENCE for PM-01 (made-up app Tidyhaus; not a real review)

Sent as: no account (forged event)
POST https://staging.tidyhaus.example/functions/v1/stripe-webhook
Authorization: Bearer [token redacted]

Response: HTTP 400
{"error":"Invalid signature"}