chore(deps): upgrade svix to 2.x#104

svix 1.99.1 -> 2.1.0. no code changes needed.

breaking changes in v2 (sourced from the installed package's src/ and .d.ts — it ships no changelog):

• ESM-only, "type": "module", single . export, no CJS entry at all
• engines.node bumped to >=22 (we're on 22.x, fine)
• Webhook is now a thin wrapper over standardwebhooks@1.0.0 instead of inline HMAC
• WebhookVerificationError re-exported from standardwebhooks, so different class identity — only matters for instanceof, we don't do any
• svix-* -> webhook-* header normalization moved into the wrapper, both shapes still accepted

unchanged: constructor signature, verify(payload, headers) signature, and its return type. convex/http.ts needed nothing.

signature verification (the security-sensitive bit) — traced the full path, semantics identical and still fails closed:

• same whsec_ prefix strip + base64 decode
• same 5 min tolerance, rejects too-old and too-new
• same v1,<b64 hmac-sha256> over ${msgId}.${timestamp}.${payload}
• still timing-safe comparison
• every failure path throws; no path returns without a matching signature
• our ?? "" header fallbacks in convex/http.ts hit the missing-headers throw, propagate to the catch, return null, request rejected

checks: typecheck clean, 203/203 tests, build ok. also bundled convex/http.ts with esbuild separately — the Next build doesn't cover convex files, so the ESM-only change wouldn't have been caught otherwise.

fyi @convex-dev/resend still pulls a nested svix@1.99.1, so two copies coexist until it updates. isolated, harmless.

RNGO-42 · part of RNGO-40 (dependency upgrade sweep) https://linear.app/mihaicrisan/issue/rngo-42/upgrade-svix-to-210-pr-104