feat(examples): add Transaction Review webhook reference server

[devin-ai-integration]

Summary

Adds a runnable reference server for Dynamic's Transaction Review webhooks, relocated from dynamic-labs/redcoast PR #10613 (a customer-facing example that shouldn't ship inside the redcoast monorepo). Pairs with the new docs page: https://docs.dynamic.xyz/overview/wallets/embedded-wallets/mpc/transaction-review

New standalone example examples/nodejs-transaction-review-webhook/ (Express + tsx, no @dynamic-labs deps — it's a webhook receiver):

• src/server.ts — POST /webhook that:
  • verifies the inbound x-dynamic-signature (HMAC-SHA256, timing-safe) against WEBHOOK_SECRET; missing/wrong → 401 { proceed: false, reason: "Invalid signature" }
  • optionally Ed25519-signs the response over the exact raw bytes sent (x-dynamic-response-signature)
  • exposes hot-switchable modes via ?mode=allow|deny|slow|crash for exercising the approve path, denials, timeouts (failure policy), and transport failures
• src/keygen.ts — generates an Ed25519 keypair and prints the public PEM to paste into the dashboard
• README.md, .env.example, tsconfig.json, package.json, pnpm-lock.yaml

Adapted from the redcoast source: doc links now point at docs.dynamic.xyz, install/scripts use pnpm (matching sibling nodejs-* examples), and the dashboard nav wording is aligned to Wallets → Transaction Review (the redcoast copy was internally inconsistent — keygen/README said "Embedded Wallets → Advanced Settings").

Verified locally

• tsc --noEmit clean.
• Server round-trip: valid HMAC → 200 { proceed: true } with a populated x-dynamic-response-signature; bad signature → 401; ?mode=deny → { proceed: false, reason: ... }.

(pnpm <script> is blocked in the CI sandbox by a supply-chain policy that treats esbuild's ignored build script as fatal; tsx runs fine directly. Not an issue for end users.)

Link to Devin session: https://dynamicxyz.devinenterprise.com/sessions/c8159805dae849e683126df58ce473cf
Requested by: @doctorloaf

[devin-ai-integration]

Original prompt from ndavis

SYSTEM:
=== BEGIN THREAD HISTORY (in #devin--external-policies) ===
<most_recent_message>
Noah Davis (U09TRSY2UF6): @Devin - we have a bunch of docs in this PR that should actually go in our documentation repo. Would you agree?
<https://app.graphite.com/github/pr/dynamic-labs/redcoast/10613|app.graphite.com/github/…/10613>
</most_recent_message>
=== END THREAD HISTORY ===

Thread URL: https://dynamiclabsgroup.slack.com/archives/C0B5MJ1TET0/p1784121363434229?thread_ts=1784121363.434229&amp;cid=C0B5MJ1TET0

The latest message is the one right above that tagged you. The <most_recent_message> is the message that you should use to guide your goals + task for this session, and you should use the rest of the slack thread as context.

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
kamino	Error		Jul 15, 2026 1:41pm
nextjs-iron-ramp	Ready	Preview, Comment	Jul 15, 2026 1:41pm
predictions-market-demo	Ready	Preview, Comment	Jul 15, 2026 1:41pm

[vercel]

Deployment failed with the following error:

There is no GitHub account connected to this Vercel account.