Receive a webhook from a configured alert source.
Verifies the webhook signature, validates the payload structure, and enqueues the enrichment pipeline. Returns 202 immediately.
Allowed sources check: if the API key has allowed_sources set,
the requested source_name must be in that list.