HMAC-verified referral and Lexamica outcome webhooks enqueue to SQS. Thin public receiver only — no DB, gates, or LLM in this process.