refactor: update AbacatePay webhook auth to use query param secret

- Replaced signature-based verification with secret validation using webhookSecret query parameter for improved compatibility
- Added CORS headers in next.config.ts for webhook API routes to handle external requests from varying IPs
- Updated abacatepay.ts verifyWebhookSignature method for backward compatibility, now delegating validation to route handler

next.config.ts

@@ -5,6 +5,28 @@ const withNextIntl = createNextIntlPlugin("./i18n/request.ts");
 
 const nextConfig: NextConfig = {
   /* config options here */
+  async headers() {
+    return [
+      {
+        // Aplicar CORS apenas para rotas de API
+        source: "/api/webhooks/:path*",
+        headers: [
+          {
+            key: "Access-Control-Allow-Origin",
+            value: "*", // AbacatePay envia de IPs variados
+          },
+          {
+            key: "Access-Control-Allow-Methods",
+            value: "POST, GET, OPTIONS",
+          },
+          {
+            key: "Access-Control-Allow-Headers",
+            value: "Content-Type, Authorization",
+          },
+        ],
+      },
+    ];
+  },
 };
 
 export default withNextIntl(nextConfig);