Verify

Validate the API key and return org context + webhook secret.

The webhook_secret is the value clients must use to verify the X-Overten-Signature header on webhooks (see :doc:backend/docs/api/SECURITY.md).