whop-sync: POST /api/whop-webhook