Add request signing for API-to-API communication

[Smartdevs17]

Description

Internal API-to-API communication has no request authentication mechanism beyond network-level controls. Implement cryptographic request signing for internal services.

Acceptance Criteria

• HMAC-based request signing for internal APIs
• Timestamp-based replay protection (5min window)
• Key rotation with overlapping validity periods
• Signature verification middleware
• Audit logging for inter-service calls
• Performance impact assessment

Technical Scope

• backend/src/middleware/
• backend/src/services/signature-verification.ts
• Edge: clock skew tolerance, signature generation for large bodies, key compromise