fix: support svix-* headers for Polar webhooks, extend timestamp window

src/lib/payments/polar.ts

@@ -64,9 +64,9 @@ export function verifyPolarWebhook(
 ): boolean {
   if (!WEBHOOK_SECRET) return false;
 
-  // Timestamp replay saldırısı koruması (5 dakika tolerans)
+  // Timestamp replay koruması (1 saat — Polar retry aralığı uzun olabilir)
   const ts = parseInt(webhookTimestamp, 10);
-  if (isNaN(ts) || Math.abs(Date.now() / 1000 - ts) > 300) return false;
+  if (isNaN(ts) || Math.abs(Date.now() / 1000 - ts) > 3600) return false;
 
   const signedContent = `${webhookId}.${webhookTimestamp}.${rawBody}`;