Tasks

The /api/users endpoint currently returns all users at once. Add cursor-based pagination with configurable page size (default 20, max 100). Include total count in response headers.

Users report intermittent 401 errors after login. The session token is being validated before the database write completes. Fix the race condition in the auth middleware.

Add HMAC-SHA256 signature verification to all incoming webhook endpoints. Reject payloads with missing or invalid signatures. Log verification failures for security monitoring.